Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.508exploits catalogados

40.258CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.095Exploit-DB 24.488GitHub PoC 17.831VulnCheck XDB 10.015Nuclei 4547Metasploit 3532✓ solo verificadosrecientes populares riesgo

17.831 exploits

GitHub PoC

Gilospy/CVE-2022-26134

CVE-2022-26134CRITICALbajo ataqueransomware13 oct 2024

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RIESGO

abrir ↗

GitHub PoC

lemonadern/poc-cve-2019-14287

CVE-2019-14287—13 oct 2024

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and se

35RIESGO

abrir ↗

GitHub PoC★ 1

PoC for RCE in SQLPad (CVE-2022-0944)

CVE-2022-0944CRITICAL13 oct 2024

Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

48RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2021-40539：ADSelfService Plus RCE漏洞

CVE-2021-40539CRITICALbajo ataqueransomware12 oct 2024

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta

100RIESGO

abrir ↗

GitHub PoC

CVE-2021-40539：ADSelfService Plus RCE漏洞

CVE-2021-40539CRITICALbajo ataqueransomware12 oct 2024

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta

100RIESGO

abrir ↗

GitHub PoC

intel365/CVE-2024-7593

CVE-2024-7593CRITICALbajo ataque12 oct 2024

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo

100RIESGO

abrir ↗

GitHub PoC★ 2

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'

CVE-2024-8529CRITICAL12 oct 2024

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'

68RIESGO

abrir ↗

GitHub PoC★ 1

OxLmahdi/cve-2024-5932

CVE-2024-5932CRITICAL11 oct 2024

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

85RIESGO

abrir ↗

GitHub PoC★ 1

Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

CVE-2024-9707CRITICAL11 oct 2024

Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

63RIESGO

abrir ↗

GitHub PoC

Checkpoint SQL Injection via Time-Based Attack (CVE-2024-9465)

CVE-2024-9465CRITICALbajo ataque11 oct 2024

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

100RIESGO

abrir ↗

GitHub PoC★ 1

test_private_CVE

CVE-2024-23113CRITICALbajo ataque11 oct 2024

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.

90RIESGO

abrir ↗

GitHub PoC★ 6

p33d/CVE-2024-9441

CVE-2024-9441CRITICAL10 oct 2024

Linear eMerge e3-Series Forgot Password Command Injection

60RIESGO

abrir ↗

GitHub PoC★ 2

intel365/CVE-2024-29973

CVE-2024-29973CRITICAL10 oct 2024

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar

85RIESGO

abrir ↗

GitHub PoC★ 5

is a PoC tool designed to exploit insecurely exposed debug logs from WordPress sites and extract session cookies

CVE-2024-44000CRITICAL10 oct 2024

WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

85RIESGO

abrir ↗

GitHub PoC★ 44

Proof of Concept Exploit for CVE-2024-9464

CVE-2024-9464CRITICAL09 oct 2024

Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

70RIESGO

abrir ↗

GitHub PoC★ 1

intel365/CVE-2024-24919

CVE-2024-24919HIGHbajo ataqueransomware09 oct 2024

Information disclosure

100RIESGO

abrir ↗

GitHub PoC★ 27

Unauthenticated Remote Code Execution via Angular-Base64-Upload Library

CVE-2024-42640CRITICAL09 oct 2024

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo

75RIESGO

abrir ↗

GitHub PoC★ 17

CVE-2024-38077: Remote Code Execution Vulnerability in Windows Remote Desktop Licensing Service

CVE-2024-38077CRITICAL09 oct 2024

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC★ 3

is a PoC tool that targets a vulnerability in the TeamCity server (CVE-2024-27198)

CVE-2024-27198CRITICALbajo ataqueransomware09 oct 2024

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

100RIESGO

abrir ↗

GitHub PoC★ 31

Proof of Concept Exploit for CVE-2024-9465

CVE-2024-9465CRITICALbajo ataque09 oct 2024

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

100RIESGO

abrir ↗

GitHub PoC★ 2

intel365/CVE-2024-2876

CVE-2024-2876CRITICAL09 oct 2024

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

85RIESGO

abrir ↗

GitHub PoC★ 1

Proof of Concept for the Log4Shell vulnerability (CVE-2021-44228), developed as part of the coursework for the curricular unit TPAS in the Master's degree in Information Security at FCUP.

CVE-2021-44228CRITICALbajo ataqueransomware08 oct 2024

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC★ 1

Agilevatester/FlaskCache_CVE-2021-33026_POC

CVE-2021-33026CRITICAL08 oct 2024

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code e

48RIESGO

abrir ↗

GitHub PoC

wargame, CVE-2024-4367

CVE-2024-4367MEDIUM08 oct 2024

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RIESGO

abrir ↗

GitHub PoC

bka/magento-cve-2024-34102-exploit-cosmicstring

CVE-2024-34102CRITICALbajo ataque08 oct 2024

XXE can expose crypt key and other secrets granting full admin access

100RIESGO

abrir ↗

GitHub PoC

TeamCity server scanner to detect CVE-2023-42793

CVE-2023-42793CRITICALbajo ataqueransomware08 oct 2024

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

100RIESGO

abrir ↗

GitHub PoC★ 1

Performs an IPv6 vulnerability scan and packet flood attack on specified targets. The script simulates a SYN flood and ICMP flood attack and optionally sends exploit packets.

CVE-2024-38063CRITICAL08 oct 2024

Windows TCP/IP Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC

The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attac

CVE-2024-1207CRITICAL08 oct 2024

Booking Calendar <= 9.9 - Unauthenticated SQL Injection

48RIESGO

abrir ↗

GitHub PoC

Apache CouchDB 3.2.1 - Remote Code Execution (RCE) Checker

CVE-2022-24706CRITICALbajo ataque08 oct 2024

Remote Code Execution Vulnerability in Packaging

100RIESGO

abrir ↗

GitHub PoC★ 1

Automated Exploit for CVE-2020-6287

CVE-2020-6287CRITICALbajo ataque07 oct 2024

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication c

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.