Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.180exploits catalogados

31.691CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.469Referência 19.841GitHub PoC 13.140VulnCheck XDB 8078Nuclei 4190Metasploit 3462✓ solo verificadosrecientes populares riesgo

13.140 exploits

GitHub PoC

CVE-2025-14847

CVE-2025-14847HIGHbajo ataque23 feb 2026

Zlib compressed protocol header length confusion may allow memory read

100RIESGO

abrir ↗

GitHub PoC

SonicWall security audit toolkit with vulnerable CTF lab (CVE-2021-20038, CVE-2024-53704)

CVE-2021-20038CRITICALbajo ataqueransomware23 feb 2026

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows

100RIESGO

abrir ↗

GitHub PoC

CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware23 feb 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

SonicWall security audit toolkit with vulnerable CTF lab (CVE-2021-20038, CVE-2024-53704)

CVE-2024-53704HIGHbajo ataqueransomware23 feb 2026

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authe

100RIESGO

abrir ↗

GitHub PoC★ 2

tempiltin/CVE-2025-10353-POC

CVE-2025-10353CRITICAL23 feb 2026

Missing Authorization vulnerability in Melis Platform

63RIESGO

abrir ↗

GitHub PoC

RCE for WingFTP v4.7.3

CVE-2025-47812CRITICALbajo ataque22 feb 2026

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o

100RIESGO

abrir ↗

GitHub PoC

Stored Cross-Site Scripting in "usememos" via SVG

CVE-2025-50738CRITICAL22 feb 2026

The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a us

48RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2023-43208: Mirth Connect Pre-Auth RCE PoC

CVE-2023-43208CRITICALbajo ataqueransomware22 feb 2026

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that

100RIESGO

abrir ↗

GitHub PoC★ 1

PoC for Mirth Connect Remote Code Execution (RCE)

CVE-2023-43208CRITICALbajo ataqueransomware22 feb 2026

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that

100RIESGO

abrir ↗

GitHub PoC★ 1

Educational lab demonstrating CVE-2021-36934 (HiveNightmare) - Windows LPE via shadow copy ACL misconfiguration.

CVE-2021-36934HIGHbajo ataque22 feb 2026

Windows Elevation of Privilege Vulnerability

98RIESGO

abrir ↗

GitHub PoC

danilo1992-sys/CVE-2025-32463

CVE-2025-32463CRITICALbajo ataque22 feb 2026

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

abrir ↗

GitHub PoC

PoC exploit for CVE-2024-46987 — Camaleon CMS arbitrary path traversal (file read)

CVE-2024-46987HIGH22 feb 2026

Arbitrary path traversal in Camaleon CMS

61RIESGO

abrir ↗

GitHub PoC

its970/CVE-2025-68645

CVE-2025-68645HIGHbajo ataque21 feb 2026

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1

98RIESGO

abrir ↗

GitHub PoC★ 1

Exploitation de CVE-2022-26923

CVE-2022-26923HIGHbajo ataque21 feb 2026

Active Directory Domain Services Elevation of Privilege Vulnerability

100RIESGO

abrir ↗

GitHub PoC

The flaw allows an attacker to execute arbitrary system commands on the server hosting the Pterodactyl Panel without any prior authentication.

CVE-2025-49132CRITICAL21 feb 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

68RIESGO

abrir ↗

GitHub PoC

Path traversal vulnerability in Python's tarfile.

CVE-2025-4517CRITICAL20 feb 2026

Arbitrary writes via tarfile realpath overflow

48RIESGO

abrir ↗

GitHub PoC

A proof of concept for CVE-2025-31161, using mangled HTTP header to perform unauthenticated impersonation of any user in Crush FTP server.

CVE-2025-31161CRITICALbajo ataqueransomware20 feb 2026

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RIESGO

abrir ↗

GitHub PoC

CVE-2022-37969 poc

CVE-2022-37969HIGHbajo ataque20 feb 2026

Windows Common Log File System Driver Elevation of Privilege Vulnerability

76RIESGO

abrir ↗

GitHub PoC

C reimplementation of chwoot PoC

CVE-2025-32463CRITICALbajo ataque20 feb 2026

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

abrir ↗

GitHub PoC

A practical lab demonstrating the exploitation of a critical Remote Code Execution (RCE) vulnerability in Apache Struts2 (CVE-2017-5638) using Vulhub Docker environments. Includes setup instructions and commands to run the vulnerable container.

CVE-2017-5638CRITICALbajo ataqueransomware20 feb 2026

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

abrir ↗

GitHub PoC

CVE-2014-6271 Exploit | by infrar3d

CVE-2014-6271CRITICALbajo ataque19 feb 2026

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2025-71243 - SPIP Saisies Plugin RCE (Unauthenticated PHP Code Injection)

CVE-2025-71243CRITICAL19 feb 2026

SPIP Saisies Plugin < 5.11.1 Remote Code Execution

63RIESGO

abrir ↗

GitHub PoC

CVE-2022-24521 poc

CVE-2022-24521HIGHbajo ataqueransomware19 feb 2026

Windows Common Log File System Driver Elevation of Privilege Vulnerability

71RIESGO

abrir ↗

GitHub PoC★ 1

这是基于cve-2016-4437简单的漏洞复现代码

CVE-2016-4437CRITICALbajo ataque19 feb 2026

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack

100RIESGO

abrir ↗

GitHub PoC★ 1

Unauthenticated remote code execution vulnerability in Wing FTP Server <= 7.4.3.

CVE-2025-47812CRITICALbajo ataque19 feb 2026

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o

100RIESGO

abrir ↗

GitHub PoC★ 1

Command injection vulnerability in elFinder <= 2.1.47 via the PHP connector component. Allows unauthenticated remote code execution as the web server user.

CVE-2019-9194—18 feb 2026

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

60RIESGO

abrir ↗

GitHub PoC★ 1

orgito1015/CVE-2025-55182-Researching-process

CVE-2025-55182CRITICALbajo ataqueransomware18 feb 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

Unauthenticated remote code execution vulnerability in WordPress Bricks Builder <= 1.9.6. The template render endpoint accepts PHP code without authentication, allowing arbitrary command execution as the web server user.

CVE-2024-25600CRITICAL18 feb 2026

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RIESGO

abrir ↗

GitHub PoC

Exploit for CVE-2024-6232 - Python Tarfile Realpath Overflow

CVE-2025-4517CRITICAL18 feb 2026

Arbitrary writes via tarfile realpath overflow

48RIESGO

abrir ↗

GitHub PoC

A deep-dive security analysis into the 2020 Virgin Mobile KSA data breach. This study dissects the exploitation of CVE-2020-0688, evaluates the impact of delayed patch management, and proposes a robust multi-layered defense architecture to prevent sophisticated exfiltration tactics.

CVE-2020-0688HIGHbajo ataqueransomware18 feb 2026

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.