Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.634exploits catalogados

40.286CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.110Exploit-DB 24.488GitHub PoC 17.941VulnCheck XDB 10.016Nuclei 4547Metasploit 3532✓ solo verificadosrecientes populares riesgo

17.941 exploits

GitHub PoC★ 1

Chamilo LMS Unauthenticated Remote Code Execution

CVE-2023-4220HIGH07 jul 2024

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RIESGO

abrir ↗

GitHub PoC

CosmicSting (CVE-2024-34102) POC / Patch Validator

CVE-2024-34102CRITICALbajo ataque07 jul 2024

XXE can expose crypt key and other secrets granting full admin access

100RIESGO

abrir ↗

GitHub PoC

YISF 2024 CTF-Web (Directory Traversal via ".tar" file, CVE-2007-4559), easy

CVE-2007-4559CRITICAL07 jul 2024

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows

53RIESGO

abrir ↗

GitHub PoC

RCE Chamilo 1.11.24

CVE-2023-4220HIGH07 jul 2024

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RIESGO

abrir ↗

GitHub PoC★ 5

This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220

CVE-2023-4220HIGH07 jul 2024

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RIESGO

abrir ↗

GitHub PoC★ 1

Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.

CVE-2023-4220HIGH07 jul 2024

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RIESGO

abrir ↗

GitHub PoC

sysonlai/CVE-2024-32002-hook

CVE-2024-32002CRITICAL07 jul 2024

Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

53RIESGO

abrir ↗

GitHub PoC★ 56

Remote Code Execution (RCE) Vulnerability In Evaluating Property Name Expressions with multies ways to exploit

CVE-2024-36401CRITICALbajo ataque06 jul 2024

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

100RIESGO

abrir ↗

GitHub PoC★ 7

PoC - PHP CGI Argument Injection CVE-2024-4577 (Scanner and Exploit)

CVE-2024-4577CRITICALbajo ataqueransomware06 jul 2024

Argument Injection in PHP-CGI

100RIESGO

abrir ↗

GitHub PoC★ 1

TeamCity RCE for Linux (CVE-2023-42793)

CVE-2023-42793CRITICALbajo ataqueransomware05 jul 2024

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

100RIESGO

abrir ↗

GitHub PoC

CVE-2024-39943 rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).

CVE-2024-39943CRITICAL05 jul 2024

rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote auth

60RIESGO

abrir ↗

GitHub PoC★ 44

该漏洞存在于 NtQueryInformationToken 函数中，特别是在处理AuthzBasepCopyoutInternalSecurityAttributes 函数时，该漏洞源于内核在操作对象时对锁定机制的不当管理，这一失误可能导致恶意实体意外提升权限。

CVE-2024-30088HIGHbajo ataqueransomware05 jul 2024

Windows Kernel Elevation of Privilege Vulnerability

83RIESGO

abrir ↗

GitHub PoC★ 1

TeamCity RCE for Linux (CVE-2023-42793)

CVE-2023-42793CRITICALbajo ataqueransomware05 jul 2024

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

100RIESGO

abrir ↗

GitHub PoC

puckiestyle/CVE-2023-27532-RCE-Only

CVE-2023-27532HIGHbajo ataqueransomware05 jul 2024

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database

93RIESGO

abrir ↗

GitHub PoC★ 5

Vulnerability remediation and mitigationCVE-2024-6387

CVE-2024-6387HIGH05 jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

GitHub PoC★ 4

POC

CVE-2024-36401CRITICALbajo ataque05 jul 2024

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

100RIESGO

abrir ↗

GitHub PoC★ 1

Quick regreSSHion checker (based on software version) for nuclei CVE-2024-6387

CVE-2024-6387HIGH05 jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2024-37770

CVE-2024-37770CRITICAL05 jul 2024

14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. This

48RIESGO

abrir ↗

GitHub PoC

imv7/CVE-2024-6387

CVE-2024-6387HIGH05 jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

GitHub PoC★ 392

HikvisionExploiter is a Python-based utility designed to automate exploitation and directory accessibility checks on Hikvision network cameras exploiting the Web interface Version 3.1.3.150324 + CVE-2021-36260 Detection

CVE-2021-36260CRITICALbajo ataque05 jul 2024

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RIESGO

abrir ↗

GitHub PoC★ 10

HASSH fingerprints for identifying OpenSSH servers potentially vulnerable to CVE-2024-6387 (regreSSHion).

CVE-2024-6387HIGH05 jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

GitHub PoC★ 59

GNU IFUNC is the real culprit behind CVE-2024-3094

CVE-2024-3094CRITICAL05 jul 2024

Xz: malicious code in distributed source

70RIESGO

abrir ↗

GitHub PoC★ 2

SSH EXPLOIT BYPASS AUTH SSH

CVE-2024-3094CRITICAL05 jul 2024

Xz: malicious code in distributed source

70RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2024-4040 PoC

CVE-2024-4040CRITICALbajo ataque05 jul 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

abrir ↗

GitHub PoC★ 1

Exploiter a Vulnerability detection and Exploitation tool for GeoServer Unauthenticated Remote Code Execution CVE-2024-36401.

CVE-2024-36401CRITICALbajo ataque05 jul 2024

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

100RIESGO

abrir ↗

GitHub PoC★ 34

POC for CVE-2024-36401. This POC will attempt to establish a reverse shell from the vlun targets.

CVE-2024-36401CRITICALbajo ataque04 jul 2024

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

100RIESGO

abrir ↗

GitHub PoC

CVE-2017-12617

CVE-2017-12617HIGHbajo ataque04 jul 2024

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT

100RIESGO

abrir ↗

GitHub PoC

sms2056/CVE-2024-6387

CVE-2024-6387HIGH04 jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

GitHub PoC

iamz24/CVE-2021-3493_CVE-2022-3357

CVE-2021-3493HIGHbajo ataque04 jul 2024

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

98RIESGO

abrir ↗

GitHub PoC

rewrited SSH Exploit for CVE-2024-6387 (regreSSHion)

CVE-2024-6387HIGH04 jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.