Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.412exploits catalogados

40.212CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 10.014Nuclei 4547Metasploit 3531✓ solo verificadosrecientes populares riesgo

17.762 exploits

GitHub PoC★ 3

CVE-2024-56902 - Information disclosure vulnerability in GeoVision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password.

CVE-2024-56902HIGH02 feb 2025

Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which

46RIESGO

GitHub PoC

rehan6658/CVE-2023-40028

CVE-2023-40028MEDIUM02 feb 2025

Arbitrary file read via symlinks in Ghost

45RIESGO

GitHub PoC★ 1

This code is taken from "Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)" and was converted to Python 3 to suit the exercise in Academy for Module "Attacking Commoon Applications" and section "Attacking Drupal".

CVE-2014-3704—02 feb 2025

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct

60RIESGO

GitHub PoC

CVE-2017-8869 - MediaCoder 0.8.48.5888 - Local Buffer Overflow (SEH)

CVE-2017-8869—02 feb 2025

Buffer overflow in MediaCoder 0.8.48.5888 allows remote attackers to execute arbitrary code via a crafted .m3u file.

43RIESGO

GitHub PoC★ 2

CVE-2024-56901 - A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASManager web application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Admin accounts via a crafted POST request.

CVE-2024-56901HIGH02 feb 2025

A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less tha

41RIESGO

GitHub PoC★ 2

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

CVE-2024-10924CRITICAL02 feb 2025

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RIESGO

GitHub PoC★ 1

hashdr1ft/SOC274-Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400

CVE-2024-3400CRITICALbajo ataqueransomware02 feb 2025

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

100RIESGO

GitHub PoC

User Profile Builder <= 3.11.7 - Unauthenticated Media Upload

CVE-2024-6366CRITICAL02 feb 2025

User Profile Builder < 3.11.8 - Unauthenticated Media Upload

68RIESGO

GitHub PoC★ 1

## About The script has been made for exploiting the Laravel RCE (CVE-2021-3129) vulnerability.<br> This script allows you to write/execute commands on a website running <b>Laravel <= v8.4.2</b>, that has "APP_DEBUG" set to "true" in its ".env" file.

CVE-2021-3129CRITICALbajo ataqueransomware30 ene 2025

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RIESGO

GitHub PoC

asepsaepdin/CVE-2022-36804

CVE-2022-36804HIGHbajo ataque30 ene 2025

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef

100RIESGO

GitHub PoC★ 50

An XNU kernel race condition bug

CVE-2025-24118CRITICAL30 ene 2025

The issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.4, macOS Sequoia 15.3, macOS S

48RIESGO

GitHub PoC

asepsaepdin/CVE-2021-42013

CVE-2021-42013CRITICALbajo ataqueransomware30 ene 2025

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RIESGO

GitHub PoC

asepsaepdin/CVE-2023-32315

CVE-2023-32315HIGHbajo ataque30 ene 2025

Openfire administration console authentication bypass

100RIESGO

GitHub PoC★ 15

CVE-2024-8381: A SpiderMonkey Interpreter Type Confusion Bug.

CVE-2024-8381CRITICAL30 ene 2025

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as t

48RIESGO

GitHub PoC

lukwagoasuman/-home-lukewago-Downloads-CVE-2021-23017-Nginx-1.14

CVE-2021-23017—30 ene 2025

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from t

35RIESGO

GitHub PoC★ 6

Proof of Concept for CVE-2022-45460

CVE-2022-45460CRITICAL30 ene 2025

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C74311

48RIESGO

GitHub PoC★ 4

honeyb33z/cve-2020-11023-scanner

CVE-2020-11023MEDIUMbajo ataque30 ene 2025

Potential XSS vulnerability in jQuery

85RIESGO

GitHub PoC

asepsaepdin/CVE-2022-33891

CVE-2022-33891HIGHbajo ataque30 ene 2025

Apache Spark shell command injection vulnerability via Spark UI

100RIESGO

GitHub PoC

Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

CVE-2024-11972CRITICAL29 ene 2025

Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

75RIESGO

GitHub PoC★ 1

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

CVE-2024-12084CRITICAL29 ene 2025

Rsync: heap buffer overflow in rsync due to improper checksum length handling

70RIESGO

GitHub PoC★ 1

bsec404/CVE-2020-0796

CVE-2020-0796CRITICALbajo ataqueransomware29 ene 2025

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RIESGO

GitHub PoC★ 11

A comprehensive all-in-one Python-based Proof of Concept script to discover and exploit a critical authentication bypass vulnerability (CVE-2024-55591) in certain Fortinet devices.

CVE-2024-55591CRITICALbajo ataqueransomware29 ene 2025

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 thro

100RIESGO

GitHub PoC★ 3

watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248

CVE-2024-48248HIGHbajo ataque28 ene 2025

NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /

100RIESGO

GitHub PoC★ 2

Ivanti Connect Secure, Policy Secure & ZTA Gateways - CVE-2025-0282

CVE-2025-0282CRITICALbajo ataqueransomware28 ene 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RIESGO

GitHub PoC★ 288

针对JWT渗透开发的漏洞验证/密钥爆破工具，针对CVE-2015-9235/空白密钥/未验证签名攻击/CVE-2016-10555/CVE-2018-0114/CVE-2020-28042的结果生成用于FUZZ，也可使用字典/字符枚举(包括JJWT)的方式进行爆破(JWT Crack)

CVE-2018-0114—27 ene 2025

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker

35RIESGO

GitHub PoC★ 1

7-Zip Mark-of-the-Web绕过漏洞PoC(CVE-2025-0411)

CVE-2025-0411HIGHbajo ataque27 ene 2025

7-Zip Mark-of-the-Web Bypass Vulnerability

83RIESGO

GitHub PoC

A rewrite of the Polkit vulnerability.

CVE-2021-4034HIGHbajo ataqueransomware27 ene 2025

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

GitHub PoC★ 77

watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591

CVE-2024-55591CRITICALbajo ataqueransomware27 ene 2025

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 thro

100RIESGO

GitHub PoC

Repository for internship test task.

CVE-2024-25600CRITICAL26 ene 2025

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RIESGO

GitHub PoC

CVE-2021-43798 working exploit

CVE-2021-43798HIGHbajo ataque26 ene 2025

Grafana path traversal

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.