Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados

40.452CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

18.044 exploits

GitHub PoC★ 377

WSO2 RCE (CVE-2022-29464) exploit and writeup.

CVE-2022-29464CRITICALbajo ataqueransomware20 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC

A pkexec CVE-2021-4034 vulnerability exploit

CVE-2021-4034HIGHbajo ataqueransomware19 abr 2022

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

abrir ↗

GitHub PoC

ms15-034 or CVE-2015-1635 批量扫描

CVE-2015-1635CRITICALbajo ataque19 abr 2022

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold an

100RIESGO

abrir ↗

GitHub PoC

CVE-2021-42013 - Apache 2.4.50

CVE-2021-42013CRITICALbajo ataqueransomware18 abr 2022

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RIESGO

abrir ↗

GitHub PoC★ 1

GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated) cve-2021-22205

CVE-2021-22205CRITICALbajo ataqueransomware18 abr 2022

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati

100RIESGO

abrir ↗

GitHub PoC

CVE-2019-15107

CVE-2019-15107CRITICALbajo ataqueransomware18 abr 2022

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RIESGO

abrir ↗

GitHub PoC★ 2

Watchguard RCE POC CVE-2022-26318

CVE-2022-26318CRITICALbajo ataque18 abr 2022

On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulner

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2015-1635-POC，指定IP与端口验证HTTP.sys漏洞是否存在

CVE-2015-1635CRITICALbajo ataque17 abr 2022

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold an

100RIESGO

abrir ↗

GitHub PoC★ 1

A Log4j vulnerability scanner is used to identify the CVE-2021-44228 and CVE_2021_45046

CVE-2021-44228CRITICALbajo ataqueransomware17 abr 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC★ 9

Scripted Linux Privilege Escalation for the CVE-2022-0847 "Dirty Pipe" vulnerability

CVE-2022-0847HIGHbajo ataque17 abr 2022

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RIESGO

abrir ↗

GitHub PoC★ 55

Exploit for CVE-2021-22204 (ExifTool) - Arbitrary Code Execution

CVE-2021-22204MEDIUMbajo ataque16 abr 2022

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RIESGO

abrir ↗

GitHub PoC★ 2

Repository containing nse script for vulnerability CVE-2022-21907. It is a component (IIS) vulnerability on Windows. It allows remote code execution. The vulnerability affects the kernel module http. sys, which handles most basic IIS operations.

CVE-2022-21907CRITICAL16 abr 2022

HTTP Protocol Stack Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC★ 157

Laravel RCE Exploit PoC - CVE-2021-3129 (user-friendly with automatic log path detection)

CVE-2021-3129CRITICALbajo ataqueransomware16 abr 2022

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RIESGO

abrir ↗

GitHub PoC

mhurts/CVE-2022-22954-POC

CVE-2022-22954CRITICALbajo ataqueransomware16 abr 2022

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa

100RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2021-44529 Ivanti EPM 云服务设备 (CSA) 中的代码注入漏洞允许未经身份验证的用户以有限的权限（nobody）执行任意代码。

CVE-2021-44529CRITICALbajo ataqueransomware16 abr 2022

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut

100RIESGO

abrir ↗

GitHub PoC★ 2

tufanturhan/CVE-2022-21971-Windows-Runtime-RCE

CVE-2022-21971HIGHbajo ataque15 abr 2022

Windows Runtime Remote Code Execution Vulnerability

83RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2022-22954 VMware Workspace ONE Access free marker SSTI

CVE-2022-22954CRITICALbajo ataqueransomware15 abr 2022

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa

100RIESGO

abrir ↗

GitHub PoC

tufanturhan/CVE-2022-0847-L-nux-PrivEsc

CVE-2022-0847HIGHbajo ataque15 abr 2022

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RIESGO

abrir ↗

GitHub PoC★ 11

Spring Cloud Gateway Actuator API SpEL Code Injection (CVE-2022-22947)

CVE-2022-22947CRITICALbajo ataque15 abr 2022

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe

100RIESGO

abrir ↗

GitHub PoC★ 27

Remote Code Execution Exploit in the RPC Library

CVE-2022-26809CRITICAL14 abr 2022

Remote Procedure Call Runtime Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC★ 32

Detects attempts and successful exploitation of CVE-2022-26809

CVE-2022-26809CRITICAL14 abr 2022

Remote Procedure Call Runtime Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC★ 7

auduongxuan/CVE-2022-26809

CVE-2022-26809CRITICAL14 abr 2022

Remote Procedure Call Runtime Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC★ 19

The poc for CVE-2022-26809 RCE via RPC will be updated here.

CVE-2022-26809CRITICAL14 abr 2022

Remote Procedure Call Runtime Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC

VVeakee/CVE-2017-12149

CVE-2017-12149CRITICALbajo ataqueransomware14 abr 2022

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter

100RIESGO

abrir ↗

GitHub PoC★ 8

Spring Cloud Function SPEL表达式注入漏洞（CVE-2022-22963）

CVE-2022-22963CRITICALbajo ataque14 abr 2022

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po

100RIESGO

abrir ↗

GitHub PoC★ 1

Proof of Concept for exploiting VMware CVE-2022-22954

CVE-2022-22954CRITICALbajo ataqueransomware14 abr 2022

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa

100RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2022-0185 exploit

CVE-2022-0185HIGHbajo ataque14 abr 2022

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio

76RIESGO

abrir ↗

GitHub PoC★ 3

Easy!Appointments < 1.4.3 - Unauthenticated PII (events) disclosure

CVE-2022-0482CRITICAL13 abr 2022

Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

75RIESGO

abrir ↗

GitHub PoC

VMware Workspace ONE Access远程代码执行漏洞 / Code By:Jun_sheng

CVE-2022-22954CRITICALbajo ataqueransomware13 abr 2022

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa

100RIESGO

abrir ↗

GitHub PoC★ 16

VMware Workspace ONE Access and Identity Manager RCE via SSTI - Test script for shodan, file or manual.

CVE-2022-22954CRITICALbajo ataqueransomware13 abr 2022

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.