Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.508exploits catalogados

40.258CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.095Exploit-DB 24.488GitHub PoC 17.831VulnCheck XDB 10.015Nuclei 4547Metasploit 3532✓ solo verificadosrecientes populares riesgo

17.831 exploits

GitHub PoC★ 1

PoC for CVE-2024-21182

CVE-2024-21182HIGHbajo ataque29 dic 2024

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

93RIESGO

abrir ↗

GitHub PoC★ 2

Hi this is a revised and enhanced code for CVE-2019-0232

CVE-2019-0232—29 dic 2024

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RIESGO

abrir ↗

GitHub PoC★ 1

Nxploited/CVE-2024-9234

CVE-2024-9234CRITICAL28 dic 2024

GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload

68RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2023-40028 PoC Exploit

CVE-2023-40028MEDIUM28 dic 2024

Arbitrary file read via symlinks in Ghost

45RIESGO

abrir ↗

GitHub PoC

Citrix Virtual Apps and Desktops (XEN) Unauthenticated RCE

CVE-2024-8069MEDIUMbajo ataque28 dic 2024

Limited remote code execution with privilege of a NetworkService Account access

68RIESGO

abrir ↗

GitHub PoC★ 2

The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. (CRITICAL)

CVE-2024-7954CRITICAL28 dic 2024

SPIP porte_plume Plugin Arbitrary PHP Execution

85RIESGO

abrir ↗

GitHub PoC

A practical proof-of-concept for CVE-2020-1472 (Zerologon) using the Impacket library to exploit Netlogon vulnerability and perform unauthorized domain controller access.

CVE-2020-1472MEDIUMbajo ataqueransomware28 dic 2024

Netlogon Elevation of Privilege Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2024-50379-exp

CVE-2024-50379CRITICAL28 dic 2024

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

60RIESGO

abrir ↗

GitHub PoC

Nxploited/CVE-2024-9933

CVE-2024-9933CRITICAL27 dic 2024

WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check

48RIESGO

abrir ↗

GitHub PoC

Malware Analysis CVE-2017-11882

CVE-2017-11882HIGHbajo ataqueransomware26 dic 2024

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RIESGO

abrir ↗

GitHub PoC

AleksaZatezalo/CVE-2020-14882

CVE-2020-14882CRITICALbajo ataque26 dic 2024

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RIESGO

abrir ↗

GitHub PoC

yoohhuu/Rocket-Chat-3.12.1-PoC-CVE-2021-22911-

CVE-2021-22911—26 dic 2024

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti

60RIESGO

abrir ↗

GitHub PoC

Testing the latset Apache Tomcat CVE-2024-50379 Vuln

CVE-2024-50379CRITICAL26 dic 2024

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

60RIESGO

abrir ↗

GitHub PoC★ 2

Drupal CVE-2024-45440

CVE-2024-45440MEDIUM26 dic 2024

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash

48RIESGO

abrir ↗

GitHub PoC★ 4

This repository contains a Python script designed to exploit CVE-2024-50379, a vulnerability that allows attackers to upload a JSP shell to a vulnerable server and execute arbitrary commands remotely. This exploit is particularly useful when the /uploads directory is either unprotected or not present on the target server.

CVE-2024-50379CRITICAL25 dic 2024

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

60RIESGO

abrir ↗

GitHub PoC★ 5

WordPress File Upload插件任意文件读取漏洞（CVE-2024-9047）批量检测脚本

CVE-2024-9047CRITICAL25 dic 2024

WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php

85RIESGO

abrir ↗

GitHub PoC★ 1

UnionTech-Software/libtheora-CVE-2024-56431-PoC

CVE-2024-56431CRITICAL25 dic 2024

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: th

48RIESGO

abrir ↗

GitHub PoC

A proof of concept of the path traversal vulnerability in the python AioHTTP library =< 3.9.1

CVE-2024-23334MEDIUM25 dic 2024

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

70RIESGO

abrir ↗

GitHub PoC

A PoC exploit for CVE-2024-10914 - D-Link Remote Code Execution (RCE)

CVE-2024-10914CRITICAL24 dic 2024

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

85RIESGO

abrir ↗

GitHub PoC★ 3

Unauthenticated Local File Inclusion

CVE-2024-12209CRITICAL24 dic 2024

WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion

68RIESGO

abrir ↗

GitHub PoC★ 1

The tool targets WordPress websites that use the Super Backup & Clone plugin and are vulnerable to arbitrary file upload.

CVE-2024-9290CRITICAL24 dic 2024

Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload

48RIESGO

abrir ↗

GitHub PoC★ 83

tomcat CVE-2024-50379/CVE-2024-56337 条件竞争文件上传exp

CVE-2024-50379CRITICAL23 dic 2024

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

60RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2024-50379利用

CVE-2024-50379CRITICAL23 dic 2024

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

60RIESGO

abrir ↗

GitHub PoC

hiteshpatra/CVE-2024-53677

CVE-2024-53677CRITICAL23 dic 2024

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

70RIESGO

abrir ↗

GitHub PoC★ 7

CVE-2024-50623 POC - Cleo Unrestricted file upload and download

CVE-2024-50623CRITICALbajo ataqueransomware23 dic 2024

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up

100RIESGO

abrir ↗

GitHub PoC★ 1

WonderCMS v3.2.0 - v3.4.2 XSS to RCE exploit

CVE-2023-41425MEDIUM22 dic 2024

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code

60RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2024-56145 SSTI to RCE - twig templates

CVE-2024-56145CRITICALbajo ataque22 dic 2024

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

100RIESGO

abrir ↗

GitHub PoC

Mitel MiCollab 企业协作平台任意文件读取漏洞(CVE-2024-41713)由于Mitel MiCollab软件的 NuPoint 统一消息 (NPM) 组件中存在身份验证绕过漏洞，并且输入验证不足，未经身份验证的远程攻击者可利用该漏洞执行路径遍历攻击，成功利用可能导致未授权访问、破坏或删除用户的数据和系统配置。影响范围：version < MiCollab 9.8 SP2 (9.8.2.12)

CVE-2024-41713CRITICALbajo ataqueransomware21 dic 2024

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

100RIESGO

abrir ↗

GitHub PoC

FOG Project CVE-2024-39914 命令执行漏洞

CVE-2024-39914CRITICAL21 dic 2024

FOG has a command injection in /fog/management/export.php?filename=

68RIESGO

abrir ↗

GitHub PoC

zesnd/cve-2017-12149

CVE-2017-12149CRITICALbajo ataqueransomware21 dic 2024

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.