Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.679exploits catalogados

40.329CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.150Exploit-DB 24.488GitHub PoC 17.946VulnCheck XDB 10.016Nuclei 4547Metasploit 3532✓ solo verificadosrecientes populares riesgo

17.946 exploits

GitHub PoC

CVE-2024-27956 WORDPRESS RCE PLUGIN

CVE-2024-27956CRITICAL03 may 2024

WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

85RIESGO

abrir ↗

GitHub PoC

Bypass for CVE-2007-4559 Trellix patch

CVE-2007-4559CRITICAL03 may 2024

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows

53RIESGO

abrir ↗

GitHub PoC★ 7

Exploit for Microsoft SmartScreen malicious execution (april 2024)

CVE-2024-29988HIGHbajo ataque03 may 2024

SmartScreen Prompt Security Feature Bypass Vulnerability

83RIESGO

abrir ↗

GitHub PoC★ 7

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

CVE-2024-4040CRITICALbajo ataque03 may 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

abrir ↗

GitHub PoC★ 1

Jenkins CVE-2024-23897: Arbitrary File Read Vulnerability

CVE-2024-23897CRITICALbajo ataqueransomware03 may 2024

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2024-21413 Microsoft Outlook RCE Exploit

CVE-2024-21413CRITICALbajo ataque03 may 2024

Microsoft Outlook Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC

xsxtw/CVE-2022-26134

CVE-2022-26134CRITICALbajo ataqueransomware02 may 2024

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RIESGO

abrir ↗

GitHub PoC

xsxtw/CVE-2019-0232

CVE-2019-0232—02 may 2024

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RIESGO

abrir ↗

GitHub PoC

ShellUnease/CVE-2024-34833-payroll-management-system-rce

CVE-2024-34833CRITICAL02 may 2024

Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_settin

48RIESGO

abrir ↗

GitHub PoC

xsxtw/SpringFramework_CVE-2022-22965_RCE

CVE-2022-22965CRITICALbajo ataque01 may 2024

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2023-32749 affecting Pydio Cells

CVE-2023-32749HIGH01 may 2024

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying t

46RIESGO

abrir ↗

GitHub PoC

xsxtw/CVE-2022-0847

CVE-2022-0847HIGHbajo ataque01 may 2024

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RIESGO

abrir ↗

GitHub PoC★ 4

jakabakos/CVE-2024-4040-CrushFTP-File-Read-vulnerability

CVE-2024-4040CRITICALbajo ataque01 may 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

abrir ↗

GitHub PoC

Neo-XeD/CVE-2024-33775

CVE-2024-33775HIGH01 may 2024

An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a cr

41RIESGO

abrir ↗

GitHub PoC

tronghoang89/cve-2019-16113

CVE-2019-16113—01 may 2024

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j

60RIESGO

abrir ↗

GitHub PoC★ 90

PoC for SQL Injection in CVE-2024-27956

CVE-2024-27956CRITICAL01 may 2024

WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

85RIESGO

abrir ↗

GitHub PoC

Update of https://github.com/1337g/CVE-2017-12149 to work with python3

CVE-2017-12149CRITICALbajo ataqueransomware30 abr 2024

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter

100RIESGO

abrir ↗

GitHub PoC

CCIEVoice2009/CVE-2024-1086

CVE-2024-1086HIGHbajo ataqueransomware30 abr 2024

Use-after-free in Linux kernel's netfilter: nf_tables component

76RIESGO

abrir ↗

GitHub PoC★ 5

Exploit CrushFTP CVE-2024-4040

CVE-2024-4040CRITICALbajo ataque30 abr 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

abrir ↗

GitHub PoC★ 5

A remote code execution vulnerability exists in the iControl REST API feature of F5's BIG-IP product. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges.

CVE-2022-1388CRITICALbajo ataqueransomware30 abr 2024

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RIESGO

abrir ↗

GitHub PoC

Exploit for CVE-2024-4040 affecting CrushFTP server in all versions before 10.7.1 and 11.1.0 on all platforms

CVE-2024-4040CRITICALbajo ataque29 abr 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

abrir ↗

GitHub PoC★ 2

This is POC for CVE-2024-2667 (InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload)

CVE-2024-2667CRITICAL28 abr 2024

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

63RIESGO

abrir ↗

GitHub PoC

exploit for CVE-2024-4040

CVE-2024-4040CRITICALbajo ataque28 abr 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

abrir ↗

GitHub PoC★ 1

nahcusira/CVE-2021-26084

CVE-2021-26084CRITICALbajo ataqueransomware28 abr 2024

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RIESGO

abrir ↗

GitHub PoC

A simple bash script to exploit Joomla! < 4.2.8 - Unauthenticated information disclosure

CVE-2023-23752MEDIUMbajo ataque28 abr 2024

[20230201] - Core - Improper access check in webservice endpoints

100RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2024-27956 WordPress Automatic < 3.92.1 - Unauthenticated SQL Injection

CVE-2024-27956CRITICAL27 abr 2024

WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

85RIESGO

abrir ↗

GitHub PoC

This repository contains a proof of concept about the exploitation of the aiohttp library for the reported vulnerability CVE-2024-23334.

CVE-2024-23334MEDIUM27 abr 2024

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

70RIESGO

abrir ↗

GitHub PoC★ 2

Exploit for GlobalProtect CVE-2024-3400

CVE-2024-3400CRITICALbajo ataqueransomware27 abr 2024

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

100RIESGO

abrir ↗

GitHub PoC

libertycityhacker/CVE-2023-43364-Exploit-CVE

CVE-2023-43364CRITICAL26 abr 2024

main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.

48RIESGO

abrir ↗

GitHub PoC

activemq-rce-cve-2023-46604

CVE-2023-46604CRITICALbajo ataqueransomware26 abr 2024

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.