Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.402exploits catalogados
39.049CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.184Exploit-DB 24.485GitHub PoC 16.124VulnCheck XDB 9617Nuclei 4473Metasploit 3519✓ solo verificadosrecientespopularesriesgo
82.419 exploits
VulnCheck XDB
initial-access
Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability
83RIESGO
abrir ↗VulnCheck XDB
initial-access
The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
60RIESGO
abrir ↗VulnCheck XDB
initial-access
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RIESGO
abrir ↗GitHub PoC★ 7
The official exploit for Froxlor Remote Code Execution CVE-2023-0315
Command Injection in froxlor/froxlor
78RIESGO
abrir ↗GitHub PoC
This is a vulnerability in the Linux kernel that was discovered and disclosed in 2017.
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before
45RIESGO
abrir ↗GitHub PoC
windows 10 SMB vulnerability
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RIESGO
abrir ↗GitHub PoC
Joomla JCK Editor 6.4.4 - 'parent' SQL Injection
The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
60RIESGO
abrir ↗GitHub PoC
Exploit for CVE-2022-40684 vulnerability
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RIESGO
abrir ↗GitHub PoC
This script implements a lab automation where I exploit CVE-2021-43798 to steal user secrets and then gain privileges on a Linux system.
Grafana path traversal
100RIESGO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗VulnCheck XDB
local
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a work
41RIESGO
abrir ↗VulnCheck XDB
initial-access
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroo
50RIESGO
abrir ↗GitHub PoC
vulnerabilities, CVE-2022-41903, and CVE-2022-23521, that affect versions 2.39 and older. Git for Windows was also patched to address an additional, Windows-specific issue known as CVE-2022-41953.
Integer overflow in `git archive`, `git log --format` leading to RCE in git
60RIESGO
abrir ↗GitHub PoC★ 2
In Paradox Security System IPR512 web panel, an unauthenticated user can input JavaScript string, such as </script> that will overwrite configurations in the file "login.xml" and cause the login form to crash and make it unavailable.
An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and l
53RIESGO
abrir ↗GitHub PoC★ 1
Relativ3Pa1n/CVE-2014-2383-LFI-to-RCE-Escalation
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroo
50RIESGO
abrir ↗VulnCheck XDB
local
KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file,
23RIESGO
abrir ↗GitHub PoC★ 2
DDoS Tool which exploits vulnerability CVE-2004-2449 from vendor GameSpy (now known as OpenSpy). User is prompted for input IP address, and port. (NOTE: Please use this responsibly, I made this as a proof of concept of vulnerability exploitation ONLY. I do not endorse DOSing, DDoSing, or cheating in any way. Use this at your own risk.)
Roger Wilco 1.4.1.6 and earlier or Roger Wilco Base Station 0.30a and earlier allows remote attackers to cause a denial
23RIESGO
abrir ↗Metasploit600
VMware vRealize Log Insight Unauthenticated RCE
The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely
85RIESGO
abrir ↗VulnCheck XDB
infoleak
KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file,
23RIESGO
abrir ↗VulnCheck XDB
local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RIESGO
abrir ↗Metasploit600
VMware vRealize Log Insight Unauthenticated RCE
VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sen
53RIESGO
abrir ↗Metasploit600
VMware vRealize Log Insight Unauthenticated RCE
The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject fi
85RIESGO
abrir ↗GitHub PoC★ 6
A proof of concept exploit for a wordpress 5.6 media library vulnerability
WordPress Authenticated XXE attack when installation is running PHP 8
63RIESGO
abrir ↗VulnCheck XDB
local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RIESGO
abrir ↗GitHub PoC★ 2
Drity Pipe Linux Kernel 1-Day Exploit
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RIESGO
abrir ↗GitHub PoC★ 1
A pwnkit N-Day exploit
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RIESGO
abrir ↗GitHub PoC★ 28
Python scanner for CVE-2022-47966. Supports ~10 of the 24 affected products.
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due
100RIESGO
abrir ↗GitHub PoC★ 2
Run on your ManageEngine server
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.