Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.508exploits catalogados

40.258CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.095Exploit-DB 24.488GitHub PoC 17.831VulnCheck XDB 10.015Nuclei 4547Metasploit 3532✓ solo verificadosrecientes populares riesgo

17.831 exploits

GitHub PoC★ 1

Proof of Concept for CVE-2024-32002

CVE-2024-32002CRITICAL27 sep 2024

Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

53RIESGO

abrir ↗

GitHub PoC

Reproduction of SQL Injection Vulnerabilities in OpenHIS

CVE-2024-46532CRITICAL27 sep 2024

SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the

48RIESGO

abrir ↗

GitHub PoC★ 1

This project contains a Python script that exploits **CVE-2023-38831**, a vulnerability in **WinRAR** versions prior to 6.23. The exploit generates a **malicious RAR archive** that triggers the execution of arbitrary code when the victim opens a benign-looking file within the archive (such as a PDF).

CVE-2023-38831HIGHbajo ataqueransomware27 sep 2024

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RIESGO

abrir ↗

GitHub PoC★ 8

Pgadmin4 Sensitive Information Exposure

CVE-2024-9014CRITICAL26 sep 2024

OAuth2 client id and secret exposed through the web browser in pgAdmin 4

63RIESGO

abrir ↗

GitHub PoC★ 5

A proof of concept of traefik CVE to understand the impact

CVE-2024-45410CRITICAL26 sep 2024

HTTP client can remove the X-Forwarded headers in Traefik

48RIESGO

abrir ↗

GitHub PoC

CVE-2023-38831HIGHbajo ataqueransomware26 sep 2024

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RIESGO

abrir ↗

GitHub PoC

p33d/CVE-2024-8275

CVE-2024-8275CRITICAL26 sep 2024

The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection

60RIESGO

abrir ↗

GitHub PoC

UMASANKAR-MG/Path-Traversal-CVE-2024-4956

CVE-2024-4956HIGH26 sep 2024

Nexus Repository 3 - Path Traversal

61RIESGO

abrir ↗

GitHub PoC★ 3

A vulnerability scanner that searches for the CVE-2024-9166 vulnerability on websites, more info about this vulnerability here: https://www.tenable.com/cve/CVE-2024-9166

CVE-2024-9166CRITICAL26 sep 2024

OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver

63RIESGO

abrir ↗

GitHub PoC★ 5

PrusaSlicer Arbitrary Code Execution using .3mf

CVE-2023-47268MEDIUM26 sep 2024

In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrar

33RIESGO

abrir ↗

GitHub PoC

CVE-2019-15107 webmin 취약점에 대해서 직접 서버를 구축하고 공격 결과를 남긴 정보입니다.

CVE-2019-15107CRITICALbajo ataqueransomware25 sep 2024

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RIESGO

abrir ↗

GitHub PoC

CVE-2024-46627 - Incorrect access control in BECN DATAGERRY v2.2 allows attackers to > execute arbitrary commands via crafted web requests.

CVE-2024-46627CRITICAL25 sep 2024

Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.

63RIESGO

abrir ↗

GitHub PoC★ 3

WBW Product Table Pro <= 1.9.4 - Unauthenticated Arbitrary SQL Execution to RCE

CVE-2024-43918CRITICAL24 sep 2024

WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability

48RIESGO

abrir ↗

GitHub PoC★ 9

CVE-2024-7593 Ivanti Virtual Traffic Manager 22.2R1 / 22.7R2 Admin Panel Authentication Bypass PoC [EXPLOIT]

CVE-2024-7593CRITICALbajo ataque24 sep 2024

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo

100RIESGO

abrir ↗

GitHub PoC★ 4

Proof-of-Concept for CVE-2024-47066

CVE-2024-47066CRITICAL24 sep 2024

Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

53RIESGO

abrir ↗

GitHub PoC★ 7

Proof of Concept Exploit for CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability

CVE-2024-28987CRITICALbajo ataque24 sep 2024

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 147

CVE-2024-38200 & CVE-2024-43609 - Microsoft Office NTLMv2 Disclosure Vulnerability

CVE-2024-38200MEDIUM24 sep 2024

Microsoft Office Spoofing Vulnerability

38RIESGO

abrir ↗

GitHub PoC★ 5

TheCyberguy-17/RCE_CVE-2024-7954

CVE-2024-7954CRITICAL23 sep 2024

SPIP porte_plume Plugin Arbitrary PHP Execution

85RIESGO

abrir ↗

GitHub PoC★ 2

vidura2/CVE-2024-46377

CVE-2024-46377CRITICAL23 sep 2024

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function

48RIESGO

abrir ↗

GitHub PoC★ 3

vidura2/CVE-2024-46986

CVE-2024-46986CRITICAL22 sep 2024

Arbitrary file write leading to RCE in Camaleon CMS

75RIESGO

abrir ↗

GitHub PoC★ 2

vidura2/CVE-2024-46451

CVE-2024-46451CRITICAL22 sep 2024

TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the de

48RIESGO

abrir ↗

GitHub PoC

CVE-2024-3273 - D-Link Remote Code Execution (RCE)

CVE-2024-3273HIGHbajo ataque21 sep 2024

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

100RIESGO

abrir ↗

GitHub PoC

Kode Eksploitasi CVE-2024-38063

CVE-2024-38063CRITICAL21 sep 2024

Windows TCP/IP Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC★ 3

Azrenom/CMS-Made-Simple-2.2.9-CVE-2019-9053

CVE-2019-9053—21 sep 2024

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RIESGO

abrir ↗

GitHub PoC

WonderCMS RCE CVE-2023-41425

CVE-2023-41425MEDIUM21 sep 2024

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code

60RIESGO

abrir ↗

GitHub PoC

yashfren/CVE-2014-0160-HeartBleed

CVE-2014-0160HIGHbajo ataque20 sep 2024

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

abrir ↗

GitHub PoC

MAHajian/CVE-2019-9978

CVE-2019-9978MEDIUMbajo ataque20 sep 2024

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RIESGO

abrir ↗

GitHub PoC

btar1gan/exploit_CVE-2022-35914

CVE-2022-35914CRITICALbajo ataque20 sep 2024

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RIESGO

abrir ↗

GitHub PoC★ 1

teamcity-exploit-cve-2023-42793

CVE-2023-42793CRITICALbajo ataqueransomware20 sep 2024

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

100RIESGO

abrir ↗

GitHub PoC

CVE-2023-47253 | Qualitor <= 8.20 RCE

CVE-2023-47253CRITICAL19 sep 2024

Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/reques

68RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.