Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.366exploits catalogados
40.212CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.070Exploit-DB 24.488GitHub PoC 17.740VulnCheck XDB 9990Nuclei 4547Metasploit 3531✓ solo verificadosrecientespopularesriesgo
17.740 exploits
GitHub PoC
congdong007/CVE-2025-29306_poc
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RIESGO
abrir ↗GitHub PoC
SAP NetWeaver Visual Composer Metadata Uploader <= 7.50 CVE-2025-31324 PoC
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RIESGO
abrir ↗GitHub PoC
Remote Code Execution (RCE) vulnerability in Apache Tomcat.
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗GitHub PoC
CVE-2024-38475 Scanner using FFUF + Seclists
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
100RIESGO
abrir ↗GitHub PoC★ 8
exploit for CVE-2025-27533, a Denial of Service (DoS) vulnerability in Apache ActiveMQ
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
33RIESGO
abrir ↗GitHub PoC
This is an exercise built around CVE-2021-3560
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile
91RIESGO
abrir ↗GitHub PoC
Tools for scan CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution (RCE)
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RIESGO
abrir ↗GitHub PoC★ 2
WordPress Frontend Login and Registration Blocks Plugin <= 1.0.7 is vulnerable to Privilege Escalation
Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover
63RIESGO
abrir ↗GitHub PoC★ 1
sap-netweaver-cve-2025-31324-check
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RIESGO
abrir ↗GitHub PoC
The Web Is Vulnerable to CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
x-middleware exploit for next.js CVE-2023–46298 cache poisoning and CVE-2025-29927 bypass
Authorization Bypass in Next.js Middleware
85RIESGO
abrir ↗GitHub PoC
Vite WASM Import Path Traversal 🛡️
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
100RIESGO
abrir ↗GitHub PoC★ 8
NULLTRACE0X/CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RIESGO
abrir ↗GitHub PoC★ 2
exploiting CVE-2025-27007, a critical unauthenticated privilege escalation vulnerability in the OttoKit (formerly SureTriggers) WordPress plugin
WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability
75RIESGO
abrir ↗GitHub PoC
abrewer251/CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
100RIESGO
abrir ↗GitHub PoC★ 2
Exploitation report of the Samba Trans2Open vulnerability (CVE-2003-0201), including tools used, exploitation steps, and protection techniques to secure systems.
Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x vers
60RIESGO
abrir ↗GitHub PoC★ 1
1Altruist/CVE-2025-46271-Reverse-Shell-PoC
Planet Technology Network Products OS Command Injection
48RIESGO
abrir ↗GitHub PoC
Hirainsingadia/CVE-2002-2154
Directory traversal vulnerability in Monkey HTTP Daemon 0.1.4 allows remote attackers to read arbitrary files via .. (do
23RIESGO
abrir ↗GitHub PoC
abrewer251/CVE-2025-1974_IngressNightmare_PoC
ingress-nginx admission controller RCE escalation
85RIESGO
abrir ↗GitHub PoC★ 1
Next.js Auth Bypass PoC Edge Runtime Env Leak via Middleware Bug
Authorization Bypass in Next.js Middleware
85RIESGO
abrir ↗GitHub PoC
NGINX DNS Overflow Vulnerability Check - CVE-2021-23017 PoC
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from t
35RIESGO
abrir ↗GitHub PoC★ 2
Proof-of-Concept (PoC) for CVE-2025-34028, a Remote Code Execution vulnerability in Commvault Command Center. This Python script scans single or multiple targets, executes commands, and reports vulnerable hosts.
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
100RIESGO
abrir ↗GitHub PoC★ 1
PoC for CVE-2025-2011 - SQLi in Depicter plugin <= 3.6.1
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
68RIESGO
abrir ↗GitHub PoC★ 5
Research Purposes only
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RIESGO
abrir ↗GitHub PoC★ 1
Commvault Remote Code Execution (CVE-2025-34028) NSE
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
100RIESGO
abrir ↗GitHub PoC★ 1
ductink98lhp/analyze-Exploit-CVE-2023-22518-Confluence
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authoriz
100RIESGO
abrir ↗GitHub PoC★ 2
Artemir7/CVE-2025-24893-EXP
Remote code execution as guest via SolrSearchMacros request in xwiki
100RIESGO
abrir ↗GitHub PoC★ 5
This Python exploit script targets a vulnerable Laravel Filemanager created by UniSharp, which allows authenticated users to bypass file restrictions and upload malicious files. This can lead to Remote Code Execution (RCE) when the uploaded payload is triggered.
Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through
48RIESGO
abrir ↗GitHub PoC★ 1
Scanner and exploit for CVE-2025-3248
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RIESGO
abrir ↗GitHub PoC★ 2
CVE-2025-4524 - Unauthenticated madara-core Wordpress theme LFI
Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion
68RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.