Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

82.863 exploits

GitHub PoC★ 1

MyBB 1.8.29 - Remote Code Execution

CVE-2022-24734HIGH15 may 2022

Remote code execution in mybb

78RIESGO

abrir ↗

GitHub PoC★ 41

The vulnerability allowed a low-privileged user to escalate privileges to domain administrator in a default Active Directory environment with the Active Directory Certificate Services (AD CS) server role installed.

CVE-2022-26923HIGHbajo ataque14 may 2022

Active Directory Domain Services Elevation of Privilege Vulnerability

100RIESGO

abrir ↗

GitHub PoC

Technical Analysis of the SMB vulnerability (CVE-2017-0143) & its impact on the vulnerable system

CVE-2017-0143HIGHbajo ataqueransomware14 may 2022

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

GitHub PoC★ 13

Tool for CVE-2022-1388

CVE-2022-1388CRITICALbajo ataqueransomware13 may 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-1388CRITICALbajo ataqueransomware13 may 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RIESGO

abrir ↗

GitHub PoC

Log4Shell Proof-Of-Concept derived from https://github.com/kozmer/log4j-shell-poc

CVE-2021-44228CRITICALbajo ataqueransomware13 may 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC★ 2

Melissa

CVE-2020-0618CRITICALbajo ataqueransomware13 may 2022

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-30525CRITICALbajo ataque13 may 2022

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat

100RIESGO

abrir ↗

GitHub PoC★ 22

Zyxel 防火墙远程命令注入漏洞（CVE-2022-30525）

CVE-2022-30525CRITICALbajo ataque13 may 2022

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat

100RIESGO

abrir ↗

GitHub PoC

testaross4/CVE-2007-2447

CVE-2007-2447—13 may 2022

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RIESGO

abrir ↗

GitHub PoC★ 4

Zyxel 防火墙未经身份验证的远程命令注入

CVE-2022-30525CRITICALbajo ataque13 may 2022

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat

100RIESGO

abrir ↗

GitHub PoC★ 33

Zyxel 防火墙远程命令注入漏洞（CVE-2022-30525）批量检测脚本

CVE-2022-30525CRITICALbajo ataque13 may 2022

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat

100RIESGO

abrir ↗

Exploit-DB

TLR-2005KSH - Arbitrary File Delete

CVE-2021-46424—webappshardware12 may 2022

Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to de

50RIESGO

abrir ↗

GitHub PoC

CVE-2021-41773 Shodan scanner

CVE-2021-41773HIGHbajo ataqueransomware12 may 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

Exploit-DB

College Management System 1.0 - 'course_code' SQL Injection (Authenticated)

CVE-2022-28079—webappsphp12 may 2022

College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.

43RIESGO

abrir ↗

GitHub PoC★ 13

F5 BIG-IP iControl REST vulnerability RCE exploit with Java including a testing LAB

CVE-2022-1388CRITICALbajo ataqueransomware12 may 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RIESGO

abrir ↗

VulnCheck XDB

remote-with-credentials

CVE-2020-0688HIGHbajo ataqueransomware12 may 2022

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o

100RIESGO

abrir ↗

Exploit-DB

Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)

CVE-2022-28080—webappsphp12 may 2022

Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.

50RIESGO

abrir ↗

GitHub PoC★ 6

Walkthrough on the exploitation of CVE-2022-26923, a vulnerability in AD Certificate Services

CVE-2022-26923HIGHbajo ataque12 may 2022

Active Directory Domain Services Elevation of Privilege Vulnerability

100RIESGO

abrir ↗

Exploit-DB

F5 BIG-IP 16.0.x - Remote Code Execution (RCE)

CVE-2022-1388CRITICALbajo ataqueransomwareremotemultiple12 may 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RIESGO

abrir ↗

GitHub PoC★ 2

Nuclei Template for CVE-2022-1388

CVE-2022-1388CRITICALbajo ataqueransomware12 may 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RIESGO

abrir ↗

GitHub PoC★ 2

Essay (and PoCs) about CVE-2021-41773, a remote code execution vulnerability in Apache 2.4.49 🕸️

CVE-2021-41773HIGHbajo ataqueransomware12 may 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-1388CRITICALbajo ataqueransomware12 may 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-1388CRITICALbajo ataqueransomware12 may 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RIESGO

abrir ↗

GitHub PoC

CVE-2020-0688_Microsoft Exchange default MachineKeySection deserialize vulnerability

CVE-2020-0688HIGHbajo ataqueransomware12 may 2022

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-41773HIGHbajo ataqueransomware12 may 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

Exploit-DB

ExifTool 12.23 - Arbitrary Code Execution

CVE-2021-22204MEDIUMbajo ataquelocallinux11 may 2022

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RIESGO

abrir ↗

GitHub PoC★ 1

Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.

CVE-2012-6636—11 may 2022

The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote atta

50RIESGO

abrir ↗

GitHub PoC

This repository consists of the python exploit for CVE-2022-1388 (F5's BIG-IP Authentication Bypass to RCE)

CVE-2022-1388CRITICALbajo ataqueransomware11 may 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RIESGO

abrir ↗

Exploit-DB

SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)

CVE-2022-28213—remotemultiple11 may 2022

When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does n

28RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.