Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.508exploits catalogados

40.258CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.095Exploit-DB 24.488GitHub PoC 17.831VulnCheck XDB 10.015Nuclei 4547Metasploit 3532✓ solo verificadosrecientes populares riesgo

17.831 exploits

GitHub PoC★ 1

Modification of: PoC of CVE-2019-14322: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2019-14322—19 sep 2024

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

50RIESGO

abrir ↗

GitHub PoC

Webrun <= 3.6.0.42 SQLi

CVE-2021-43650—19 sep 2024

WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.

23RIESGO

abrir ↗

GitHub PoC★ 6

POC_CVE-2024-46256

CVE-2024-46256CRITICAL19 sep 2024

A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add

48RIESGO

abrir ↗

GitHub PoC

CVE-2023-47253 | Qualitor <= 8.20 RCE

CVE-2023-47253CRITICAL19 sep 2024

Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/reques

68RIESGO

abrir ↗

GitHub PoC

poc of cve-2024-8752(WebIQ 2.15.9)

CVE-2024-8752CRITICAL19 sep 2024

WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability

68RIESGO

abrir ↗

GitHub PoC

CVE-2023-47253 | Qualitor <= 8.20 RCE

CVE-2023-47253CRITICAL19 sep 2024

Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/reques

68RIESGO

abrir ↗

GitHub PoC

MLFlow Path Traversal

CVE-2023-1177CRITICAL19 sep 2024

Path Traversal: '\..\filename' in mlflow/mlflow

75RIESGO

abrir ↗

GitHub PoC

safeer-accuknox/CrushFTP-cve-2024-4040-poc

CVE-2024-4040CRITICALbajo ataque18 sep 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2022-23131 Zabbix Server SAML authentication exploit

CVE-2022-23131CRITICALbajo ataque18 sep 2024

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

100RIESGO

abrir ↗

GitHub PoC★ 2

The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads

CVE-2024-43160CRITICAL17 sep 2024

WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability

63RIESGO

abrir ↗

GitHub PoC★ 3

Client Implementation for the WatchGuard SSO Agent Protocol used for Security Research (CVE-2024-6592, CVE-2024-6593, CVE-2024-6594)

CVE-2024-6592CRITICAL17 sep 2024

WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass

48RIESGO

abrir ↗

GitHub PoC★ 2

0xAgun/CVE-2024-2876

CVE-2024-2876CRITICAL17 sep 2024

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

85RIESGO

abrir ↗

GitHub PoC★ 16

CVE-2024-8190: Ivanti Cloud Service Appliance Command Injection

CVE-2024-8190HIGHbajo ataque16 sep 2024

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remo

93RIESGO

abrir ↗

GitHub PoC★ 49

This repository contains PoC for CVE-2024-7965. This is the vulnerability in the V8 that occurs only within ARM64.

CVE-2024-7965HIGHbajo ataque16 sep 2024

Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially expl

76RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2024-44000-LiteSpeed-Cache

CVE-2024-44000CRITICAL16 sep 2024

WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

85RIESGO

abrir ↗

GitHub PoC★ 4

Proof Of Concept for CVE-2023-21716 Microsoft Word Heap Corruption

CVE-2023-21716CRITICAL16 sep 2024

Microsoft Word Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC★ 4

Server-Side Template Injection Exploit

CVE-2024-32651CRITICAL16 sep 2024

Server Side Template Injection in Jinja2 allows Remote Command Execution

85RIESGO

abrir ↗

GitHub PoC★ 1

PoC code for vulnerability in webmod v0.48. Originally written in 2007, assigned CVE-2007-1260.

CVE-2007-1260—16 sep 2024

Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execut

23RIESGO

abrir ↗

GitHub PoC

Exploit a 2021 Kernel vulnerability in Ubuntu to become root almost instantly!

CVE-2021-3493HIGHbajo ataque16 sep 2024

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

98RIESGO

abrir ↗

GitHub PoC★ 5

A Bash script for Kali Linux that exploits an iOS WebKit vulnerability (CVE-2020-27950) using Metasploit and ngrok. Automates payload delivery with a public URL via ngrok, checks for required tools, handles errors, and provides an easy way to crash browsers for educational purposes only.

CVE-2020-27950MEDIUMbajo ataque15 sep 2024

A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watch

68RIESGO

abrir ↗

GitHub PoC★ 54

Pre-Auth Exploit for CVE-2024-40711

CVE-2024-40711CRITICALbajo ataqueransomware15 sep 2024

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec

100RIESGO

abrir ↗

GitHub PoC

New exploit for pyLoad v0.5.0 - Unauthenticated remote code excecution

CVE-2023-0297CRITICAL15 sep 2024

Code Injection in pyload/pyload

85RIESGO

abrir ↗

GitHub PoC★ 2

dogucyber/WordPress-Exploit-CVE-2024-1071

CVE-2024-1071CRITICAL15 sep 2024

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi

85RIESGO

abrir ↗

GitHub PoC★ 51

POC - Unauthenticated RCE Flaw in Rejetto HTTP File Server - CVE-2024-23692

CVE-2024-23692CRITICALbajo ataqueransomware15 sep 2024

Rejetto HTTP File Server 2.3m Unauthenticated RCE

100RIESGO

abrir ↗

GitHub PoC★ 1

Unauthenticated remote code execution via Calibre’s content server in Calibre <= 7.14.0.

CVE-2024-6782CRITICAL15 sep 2024

Calibre Remote Code Execution

85RIESGO

abrir ↗

GitHub PoC★ 2

chsxthwik/CVE-2024-2876

CVE-2024-2876CRITICAL14 sep 2024

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

85RIESGO

abrir ↗

GitHub PoC★ 19

Exploit for CVE-2024-29847

CVE-2024-29847CRITICAL14 sep 2024

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows

60RIESGO

abrir ↗

GitHub PoC★ 2

Robocopsita/CVE-2022-0944_RCE_POC

CVE-2022-0944CRITICAL13 sep 2024

Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

48RIESGO

abrir ↗

GitHub PoC

acidburn2049/CVE-2021-3156

CVE-2021-3156HIGHbajo ataque13 sep 2024

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

abrir ↗

GitHub PoC

0xWhoami35/CVE-2024-4879

CVE-2024-4879CRITICALbajo ataque13 sep 2024

Jelly Template Injection Vulnerability in ServiceNow UI Macros

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.