Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
77.813exploits catalogados
35.788CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.455Referência 22.549GitHub PoC 14.290VulnCheck XDB 8722Nuclei 4320Metasploit 3477✓ solo verificadosrecientespopularesriesgo
77.813 exploits
GitHub PoC★ 8
Apache APISIX batch-requests RCE(CVE-2022-24112)
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RIESGO
abrir ↗Metasploit300
GitLab GraphQL API User Enumeration
An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Priv
70RIESGO
abrir ↗GitHub PoC★ 1
Script to demonstrate the Grafana directory traversal exploit (CVE-2021-43798).
Grafana path traversal
100RIESGO
abrir ↗GitHub PoC★ 2
pykiller/CVE-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RIESGO
abrir ↗GitHub PoC★ 1
trganda/CVE-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RIESGO
abrir ↗VulnCheck XDB
infoleak
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RIESGO
abrir ↗GitHub PoC★ 8
Zabbix SSO Bypass
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RIESGO
abrir ↗Metasploit600
pfSense Diag Routes Web Shell Upload
diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data abo
40RIESGO
abrir ↗Exploit-DB
ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 - Remote File CRUD
On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, dele
35RIESGO
abrir ↗GitHub PoC★ 43
CVE-2022-24112：Apache APISIX apisix/batch-requests RCE
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RIESGO
abrir ↗GitHub PoC★ 2
mxypoo/CVE-2016-3116-DropbearSSH
CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-c
28RIESGO
abrir ↗VulnCheck XDB
initial-access
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RIESGO
abrir ↗GitHub PoC★ 29
cve-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Windows Print Spooler Remote Code Execution Vulnerability
100RIESGO
abrir ↗GitHub PoC★ 1
TheJoyOfHacking/dirkjanm-CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
100RIESGO
abrir ↗GitHub PoC
TheJoyOfHacking/SecuraBV-CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
100RIESGO
abrir ↗GitHub PoC
Apache APISIX apisix/batch-requests RCE
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RIESGO
abrir ↗Exploit-DB
WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated)
Perfect Survey < 1.5.2 - Unauthenticated SQL Injection
60RIESGO
abrir ↗VulnCheck XDB
initial-access
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗VulnCheck XDB
local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RIESGO
abrir ↗VulnCheck XDB
local
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RIESGO
abrir ↗Exploit-DB
WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated)
WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting
28RIESGO
abrir ↗Exploit-DB
FileCloud 21.2 - Cross-Site Request Forgery (CSRF)
In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.