Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
75.902exploits catalogados
34.597CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.443Referência 21.624GitHub PoC 13.727VulnCheck XDB 8410Nuclei 4231Metasploit 3467✓ solo verificadosrecientespopularesriesgo
75.902 exploits
Exploit-DB
MagnusSolution magnusbilling 7.3.0 - Command Injection
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com
85RIESGO
abrir ↗VulnCheck XDB
initial-access
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RIESGO
abrir ↗Exploit-DB
ABB Cylon FLXeon 9.3.4 - WebSocket Command Spawning
Authentication and Authorization Issues
41RIESGO
abrir ↗Exploit-DB
ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE)
Remote Code Execution (RCE) Vulnerabilities
48RIESGO
abrir ↗GitHub PoC★ 1
A Python proof-of-concept exploit for CVE-2019-15107 - an unauthenticated remote code execution vulnerability in Webmin versions 1.890 through 1.920.
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RIESGO
abrir ↗Exploit-DB
GetSimpleCMS 3.3.16 - Remote Code Execution (RCE)
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.
23RIESGO
abrir ↗Exploit-DB
CyberPanel 2.3.6 - Remote Code Execution (RCE)
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
100RIESGO
abrir ↗GitHub PoC★ 43
CVE-2024-36401 图形化利用工具，支持各个JDK版本利用以及回显、内存马实现
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
100RIESGO
abrir ↗Exploit-DB
RosarioSIS 7.6 - SQL Injection
An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunct
28RIESGO
abrir ↗Exploit-DB
LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
75RIESGO
abrir ↗GitHub PoC
ngyinkit/cve-2019-18634
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the
28RIESGO
abrir ↗Exploit-DB
phpIPAM 1.6 - Reflected Cross Site Scripting (XSS)
phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter
48RIESGO
abrir ↗Exploit-DB
ABB Cylon FLXeon 9.3.4 - System Logs Information Disclosure
Information disclosures
33RIESGO
abrir ↗GitHub PoC★ 3
Exploit PoC for CVE-2023-20198
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS
100RIESGO
abrir ↗Exploit-DB
qBittorrent 5.0.1 - MITM RCE
qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.
41RIESGO
abrir ↗Exploit-DB
Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
85RIESGO
abrir ↗Exploit-DB
flatCore 1.5 - Cross Site Request Forgery (CSRF)
A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.
23RIESGO
abrir ↗Exploit-DB
GeoVision GV-ASManager 6.1.1.0 - CSRF
A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less tha
41RIESGO
abrir ↗Exploit-DB
GeoVision GV-ASManager 6.1.0.0 - Broken Access Control
Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low p
41RIESGO
abrir ↗Exploit-DB
MiniCMS 1.1 - Cross Site Scripting (XSS)
MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={pa
23RIESGO
abrir ↗Exploit-DB
NEWS-BUZZ News Management System 1.0 - SQL Injection
code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection
33RIESGO
abrir ↗Exploit-DB
Gnuboard5 5.3.2.8 - SQL Injection
SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.
23RIESGO
abrir ↗Exploit-DB
ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated)
Remote Code Execution (RCE) Vulnerabilities
48RIESGO
abrir ↗GitHub PoC★ 18
CVE-2025-22457: Python Exploit POC Scanner to Detect Ivanti Connect Secure RCE
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7
100RIESGO
abrir ↗GitHub PoC
Exploit CVE-2025-69985 to bypass authentication and execute remote commands on FUXA versions ≤ 1.2.8 via the /api/runscript endpoint.
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnera
48RIESGO
abrir ↗Exploit-DB
flatCore 1.5.5 - Arbitrary File Upload
An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .p
23RIESGO
abrir ↗Exploit-DB
Typecho 1.3.0 - Stored Cross-Site Scripting (XSS)
A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.