Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.001exploits catalogados
40.084CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.989Exploit-DB 24.488GitHub PoC 17.519VulnCheck XDB 9945Nuclei 4531Metasploit 3529✓ solo verificadosrecientespopularesriesgo
17.519 exploits
GitHub PoC★ 1
MS08-067 | CVE-2008-4250
CVE-2008-4250CRITICALbajo ataque02 jun 2025
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RIESGO
abrir ↗
GitHub PoC★ 8
CTY-Research-1/CVE-2025-32432-PoC
CVE-2025-32432CRITICALbajo ataque01 jun 2025
Craft CMS Allows Remote Code Execution
100RIESGO
abrir ↗
GitHub PoC★ 2
CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerability.
CVE-2023-25690CRITICAL01 jun 2025
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
70RIESGO
abrir ↗
GitHub PoC★ 3
A go implementation for CVE-2024-9264 which effect grafana versions 11.0.x, 11.1.x, and 11.2.x.
CVE-2024-9264CRITICAL31 may 2025
Grafana SQL Expressions allow for remote code execution
85RIESGO
abrir ↗
GitHub PoC
Vbullettin RCE - CVE-2025-48827
CVE-2025-48827CRITICAL31 may 2025
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'
85RIESGO
abrir ↗
GitHub PoC★ 1
fatkz/CVE-2025-27590
CVE-2025-27590CRITICAL31 may 2025
In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain contr
53RIESGO
abrir ↗
GitHub PoC★ 66
Remote Code Execution via Use-After-Free in JScript.dll (CVE-2025-30397)
CVE-2025-30397HIGHbajo ataque31 may 2025
Scripting Engine Memory Corruption Vulnerability
76RIESGO
abrir ↗
GitHub PoC★ 1
This Python script exploits CVE-2025-3248 to execute arbitrary commands or spawn a reverse shell on a vulnerable system. Authentication is required to use this exploit.
CVE-2025-3248CRITICALbajo ataqueransomware31 may 2025
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RIESGO
abrir ↗
GitHub PoC
This script checks for the OpenSSH 7.7 (and prior) username enumeration vulnerability (CVE-2018-15473). It sends a malformed authentication packet and interprets the SSH server’s response to identify valid usernames.
CVE-2018-15473MEDIUM30 may 2025
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RIESGO
abrir ↗
GitHub PoC
Automated bash script which scans an ip for potential vulnerability to eternalblue using nmap and then exploit using metasploit framework which uses the CVE-2017-0144 vulnerability[Code name: EternalBlue] in (windows 7,windows 2008 servers,etc.) to gain access to a windows 7 machine and establish a reverse meterpreter shell.
CVE-2017-0144HIGHbajo ataqueransomware30 may 2025
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗
GitHub PoC★ 5
ScadaFlare Authenticated RCE Exploit Framework for ScadaBR (CVE-2021-26828) OpenPLC ScadaBR
CVE-2021-26828HIGHbajo ataque30 may 2025
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe
83RIESGO
abrir ↗
GitHub PoC
MQKGitHub/Moniker-Link-CVE-2024-21413
CVE-2024-21413CRITICALbajo ataque30 may 2025
Microsoft Outlook Remote Code Execution Vulnerability
100RIESGO
abrir ↗
GitHub PoC★ 4
WordPress TI WooCommerce Wishlist Plugin <= 2.9.2 Arbitrary File Upload
CVE-2025-47577CRITICAL30 may 2025
WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability
63RIESGO
abrir ↗
GitHub PoC
davidxbors/CVE-2024-7399-POC
CVE-2024-7399HIGHbajo ataque30 may 2025
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2
100RIESGO
abrir ↗
GitHub PoC
thompson005/CVE-2023-22527
CVE-2023-22527CRITICALbajo ataqueransomware29 may 2025
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta
100RIESGO
abrir ↗
GitHub PoC★ 5
nkuty/CVE-2025-30208-31125-31486-32395
CVE-2025-30208MEDIUM29 may 2025
Vite bypasses server.fs.deny when using `?raw??`
70RIESGO
abrir ↗
GitHub PoC★ 11
Critical Unauthenticated API Access in vBulletin
CVE-2025-48827CRITICAL29 may 2025
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'
85RIESGO
abrir ↗
GitHub PoC
vulnerable-nextjs-14-CVE-2025-29927
CVE-2025-29927CRITICAL29 may 2025
Authorization Bypass in Next.js Middleware
85RIESGO
abrir ↗
GitHub PoC
Updated exploit for CVE-2021-22911 (Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated))
CVE-2021-22911—29 may 2025
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RIESGO
abrir ↗
GitHub PoC★ 2
Telerik CVE-2017-9248 Vulnerability Scanner
CVE-2017-9248CRITICALbajo ataque28 may 2025
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
100RIESGO
abrir ↗
GitHub PoC★ 4
Exploited CVE-2025-24071 via SMB by hosting a .library-ms file inside a .tar archive. Using tar x from smbclient, the payload is extracted server-side without user interaction. Responder captures the NTLM hash once the target accesses the library.
CVE-2025-24071MEDIUM28 may 2025
Microsoft Windows File Explorer Spoofing Vulnerability
38RIESGO
abrir ↗
GitHub PoC
AzkOsDev/CVE-2021-41773
CVE-2021-41773HIGHbajo ataqueransomware28 may 2025
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗
GitHub PoC
KimJuhyeong95/cve-2024-4577
CVE-2024-4577CRITICALbajo ataqueransomware27 may 2025
Argument Injection in PHP-CGI
100RIESGO
abrir ↗
GitHub PoC★ 1
Perform Remote Code Execution using vulnerable API endpoint.
CVE-2025-3248CRITICALbajo ataqueransomware27 may 2025
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RIESGO
abrir ↗
GitHub PoC★ 3
CVE-2025-24071 Proof Of Concept
CVE-2025-24071MEDIUM27 may 2025
Microsoft Windows File Explorer Spoofing Vulnerability
38RIESGO
abrir ↗
GitHub PoC
Log4Shell (CVE-2021-44228) exploit demo for SEAS 8405. Includes a vulnerable Spring Boot app, fake LDAP server, Docker setup, MITRE mapping, incident response, and a full screen recording.
CVE-2021-44228CRITICALbajo ataqueransomware27 may 2025
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗
GitHub PoC
🔐 Python-based smart scanner for CVE-2025-29927 — Next.js middleware authentication bypass vulnerability. Detects meta refresh, keyword-based redirects, and more.
CVE-2025-29927CRITICAL26 may 2025
Authorization Bypass in Next.js Middleware
85RIESGO
abrir ↗
GitHub PoC
The scripts in this repository are made to abuse CVE-2024-42008 and CVE-2024-42009. Both of these CVEs are vulnerabilities found on Roundcube 1.6.7
CVE-2024-42008CRITICAL26 may 2025
A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7
60RIESGO
abrir ↗
GitHub PoC
Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update
CVE-2025-2907CRITICAL26 may 2025
Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update
63RIESGO
abrir ↗
GitHub PoC
Windows File Explorer Spoofing Vulnerability - CVE-2025-24071
CVE-2025-24071MEDIUM26 may 2025
Microsoft Windows File Explorer Spoofing Vulnerability
38RIESGO
abrir ↗
← anteriorpágina 277 / 584siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.