Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
82.004exploits catalogados
38.306CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 24.541Exploit-DB 24.485GitHub PoC 15.811VulnCheck XDB 9205Nuclei 4449Metasploit 3513✓ solo verificadosrecientespopularesriesgo
81.689 exploits
GitHub PoC★ 3
An rewritten POC on the CVE-2014-3704
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗VulnCheck XDB
initial-access
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗Metasploit600
Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit
Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through
60RIESGO
abrir ↗VulnCheck XDB
initial-access
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗VulnCheck XDB
initial-access
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2
100RIESGO
abrir ↗GitHub PoC★ 1
POC exploit for CVE-2024-25641
Cacti RCE vulnerability when importing packages
85RIESGO
abrir ↗GitHub PoC★ 6
CRUNZEX/CVE-2025-22968
An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account witho
48RIESGO
abrir ↗GitHub PoC★ 3
CVE-2024-4367 is a critical vulnerability (CVSS 9.8) in PDF.js, allowing arbitrary JavaScript code execution due to insufficient type checks on the FontMatrix object within PDF files.
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RIESGO
abrir ↗VulnCheck XDB
initial-access
MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit th
48RIESGO
abrir ↗GitHub PoC★ 16
YassDEV221608/CVE-2024-6387_PoC
Openssh: regresshion - race condition in ssh allows rce/dos
63RIESGO
abrir ↗Metasploit600
Clinic's Patient Management System 1.0 - Unauthenticated RCE
SourceCodester Clinics Patient Management System unrestricted upload
28RIESGO
abrir ↗GitHub PoC
Cacti v1.2.22: Unauthenticated Command Injection Vulnerability (CVE-2022-46169)
Unauthenticated Command Injection
100RIESGO
abrir ↗GitHub PoC
oalieno/CVE-2022-41924
Tailscale Windows daemon is vulnerable to RCE via CSRF
48RIESGO
abrir ↗Metasploit600
Clinic's Patient Management System 1.0 - Unauthenticated RCE
Clinics Patient Management System SQL Injection
43RIESGO
abrir ↗GitHub PoC
Powershell Script to build token for CVE-2019-1619
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability
75RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability
75RIESGO
abrir ↗VulnCheck XDB
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
70RIESGO
abrir ↗GitHub PoC
Nxploited/CVE-2023-51409
WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability
75RIESGO
abrir ↗GitHub PoC
MASS CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗VulnCheck XDB
infoleak
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
100RIESGO
abrir ↗VulnCheck XDB
infoleak
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RIESGO
abrir ↗VulnCheck XDB
initial-access
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
100RIESGO
abrir ↗VulnCheck XDB
infoleak
Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
78RIESGO
abrir ↗GitHub PoC
Exploiting CVE-2023-2825 on a VM
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a
85RIESGO
abrir ↗VulnCheck XDB
initial-access
Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution
61RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.