Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
76.008exploits catalogados
34.638CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.443Referência 21.662GitHub PoC 13.743VulnCheck XDB 8460Nuclei 4233Metasploit 3467✓ solo verificadosrecientespopularesriesgo
76.008 exploits
GitHub PoC
HFS 2.3m SERVER RCE Vulnerability exploit
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RIESGO
abrir ↗GitHub PoC★ 2
Arbitrary file read in Grafana allows an attacker to read server files by abusing a path traversal.
Grafana path traversal
100RIESGO
abrir ↗GitHub PoC
PoC exploit for CVE-2012-2982 (Webmin RCE), for educational purposes.
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid
50RIESGO
abrir ↗VulnCheck XDB
local
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o
98RIESGO
abrir ↗GitHub PoC★ 2
Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload
Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload
48RIESGO
abrir ↗VulnCheck XDB
initial-access
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Struts: File upload component had a directory traversal vulnerability
45RIESGO
abrir ↗GitHub PoC
GazettEl/CVE-2020-24186
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo
85RIESGO
abrir ↗GitHub PoC
Sornphut/OverlayFS---CVE-2021-3493
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o
98RIESGO
abrir ↗GitHub PoC
This exploit targets an unauthenticated SQL injection vulnerability in CMS Made Simple <= 2.2.9 (CVE-2019-9053). It uses a time-based blind SQL injection to extract the username, email, and password hash from the database. Additionally, it supports password cracking using a wordlist.
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RIESGO
abrir ↗GitHub PoC
x3m1Sec/CVE-2019-0232_tomcat_cgi_exploit
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RIESGO
abrir ↗GitHub PoC
Exploitation for CVE-2022-26923
Active Directory Domain Services Elevation of Privilege Vulnerability
100RIESGO
abrir ↗GitHub PoC★ 2
Combining CVE-2024-8963 & CVE-2024-8190 - For Unauthenticated RCE on Ivanti CSA 4.6 and below
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remo
93RIESGO
abrir ↗GitHub PoC★ 1
build-script for CVE-2024-46507 and CVE-2024-46508
A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti befor
56RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Active Directory Domain Services Elevation of Privilege Vulnerability
100RIESGO
abrir ↗VulnCheck XDB
initial-access
A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti befor
56RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload
41RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted func
100RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remo
93RIESGO
abrir ↗VulnCheck XDB
infoleak
Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_pas
60RIESGO
abrir ↗GitHub PoC★ 3
Python script to exploit CVE-2020-35391 on Tenda F3 V3/V4 routers, enabling unauthorized download of configuration, flash, and syslog files.
Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_pas
60RIESGO
abrir ↗GitHub PoC
GazettEl/CVE-2020-17519
Apache Flink directory traversal attack: reading remote files through the REST API
100RIESGO
abrir ↗GitHub PoC
Project on CVE-2022-30190 exploitation and mitigation strategies
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RIESGO
abrir ↗Metasploit600
Xorcom CompletePBX Authenticated Command Injection via Task Scheduler
Xorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command Injection
36RIESGO
abrir ↗Metasploit300
Xorcom CompletePBX Authenticated File Disclosure via Backup Download
Xorcom CompletePBX <= 5.2.35 Authenticated File Disclosure
28RIESGO
abrir ↗Metasploit300
Xorcom CompletePBX Arbitrary File Read and Deletion via systemDataFileName
Xorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File Deletion
36RIESGO
abrir ↗VulnCheck XDB
local
An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11
83RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.