Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

75.652exploits catalogados
34.545CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.443Referência 21.581GitHub PoC 13.708VulnCheck XDB 8225Nuclei 4228Metasploit 3467✓ solo verificadosrecientespopularesriesgo
13.689 exploits
GitHub PoC
tronghoang89/cve-2019-16113
CVE-2019-16113—01 may 2024
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j
60RIESGO
abrir ↗
GitHub PoC★ 4
jakabakos/CVE-2024-4040-CrushFTP-File-Read-vulnerability
CVE-2024-4040CRITICALbajo ataque01 may 2024
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RIESGO
abrir ↗
GitHub PoC★ 90
PoC for SQL Injection in CVE-2024-27956
CVE-2024-27956CRITICAL01 may 2024
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RIESGO
abrir ↗
GitHub PoC
PoC for CVE-2023-32749 affecting Pydio Cells
CVE-2023-32749HIGH01 may 2024
Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying t
46RIESGO
abrir ↗
GitHub PoC
xsxtw/SpringFramework_CVE-2022-22965_RCE
CVE-2022-22965CRITICALbajo ataque01 may 2024
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RIESGO
abrir ↗
GitHub PoC
xsxtw/CVE-2022-0847
CVE-2022-0847HIGHbajo ataque01 may 2024
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RIESGO
abrir ↗
GitHub PoC
Neo-XeD/CVE-2024-33775
CVE-2024-33775CRITICAL01 may 2024
An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a cr
48RIESGO
abrir ↗
GitHub PoC
CCIEVoice2009/CVE-2024-1086
CVE-2024-1086HIGHbajo ataqueransomware30 abr 2024
Use-after-free in Linux kernel's netfilter: nf_tables component
76RIESGO
abrir ↗
GitHub PoC★ 5
Exploit CrushFTP CVE-2024-4040
CVE-2024-4040CRITICALbajo ataque30 abr 2024
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RIESGO
abrir ↗
GitHub PoC
Update of https://github.com/1337g/CVE-2017-12149 to work with python3
CVE-2017-12149CRITICALbajo ataqueransomware30 abr 2024
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter
100RIESGO
abrir ↗
GitHub PoC★ 7
A remote code execution vulnerability exists in the iControl REST API feature of F5's BIG-IP product. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges.
CVE-2022-1388CRITICALbajo ataqueransomware30 abr 2024
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RIESGO
abrir ↗
GitHub PoC
Exploit for CVE-2024-4040 affecting CrushFTP server in all versions before 10.7.1 and 11.1.0 on all platforms
CVE-2024-4040CRITICALbajo ataque29 abr 2024
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RIESGO
abrir ↗
GitHub PoC★ 1
nahcusira/CVE-2021-26084
CVE-2021-26084CRITICALbajo ataqueransomware28 abr 2024
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RIESGO
abrir ↗
GitHub PoC
exploit for CVE-2024-4040
CVE-2024-4040CRITICALbajo ataque28 abr 2024
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RIESGO
abrir ↗
GitHub PoC★ 2
This is POC for CVE-2024-2667 (InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload)
CVE-2024-2667CRITICAL28 abr 2024
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗
GitHub PoC
A simple bash script to exploit Joomla! < 4.2.8 - Unauthenticated information disclosure
CVE-2023-23752MEDIUMbajo ataque28 abr 2024
[20230201] - Core - Improper access check in webservice endpoints
100RIESGO
abrir ↗
GitHub PoC★ 2
Exploit for GlobalProtect CVE-2024-3400
CVE-2024-3400CRITICALbajo ataqueransomware27 abr 2024
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
100RIESGO
abrir ↗
GitHub PoC★ 2
CVE-2024-27956 WordPress Automatic < 3.92.1 - Unauthenticated SQL Injection
CVE-2024-27956CRITICAL27 abr 2024
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RIESGO
abrir ↗
GitHub PoC
This repository contains a proof of concept about the exploitation of the aiohttp library for the reported vulnerability CVE-2024-23334.
CVE-2024-23334MEDIUM27 abr 2024
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RIESGO
abrir ↗
GitHub PoC
LamSonBinh/CVE-2018-20250
CVE-2018-20250HIGHbajo ataqueransomware26 abr 2024
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗
GitHub PoC
activemq-rce-cve-2023-46604
CVE-2023-46604CRITICALbajo ataqueransomware26 abr 2024
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RIESGO
abrir ↗
GitHub PoC★ 2
NSE script for checking the presence of CVE-2023-22515
CVE-2023-22515CRITICALbajo ataqueransomware26 abr 2024
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
100RIESGO
abrir ↗
GitHub PoC
libertycityhacker/CVE-2023-43364-Exploit-CVE
CVE-2023-43364CRITICAL26 abr 2024
main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.
48RIESGO
abrir ↗
GitHub PoC★ 14
rbih-boulanouar/CVE-2024-4040
CVE-2024-4040CRITICALbajo ataque25 abr 2024
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RIESGO
abrir ↗
GitHub PoC
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
CVE-2024-4040CRITICALbajo ataque25 abr 2024
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RIESGO
abrir ↗
GitHub PoC★ 6
POC for SQLi vulnerability in Icegram express
CVE-2024-2876CRITICAL25 abr 2024
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection
85RIESGO
abrir ↗
GitHub PoC★ 63
CVE-2024-4040 CrushFTP SSTI LFI & Auth Bypass | Full Server Takeover | Wordlist Support
CVE-2024-4040CRITICALbajo ataque25 abr 2024
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RIESGO
abrir ↗
GitHub PoC★ 6
0xr2r/CVE-2024-3400-Palo-Alto-OS-Command-Injection
CVE-2024-3400CRITICALbajo ataqueransomware25 abr 2024
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
100RIESGO
abrir ↗
GitHub PoC★ 42
CVE-2023-20198-RCE, support adding/deleting users and executing cli commands/system commands.
CVE-2023-20198CRITICALbajo ataque25 abr 2024
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS
100RIESGO
abrir ↗
GitHub PoC
Check to see if your Palo Alto firewall has been compromised by running script againt support bundle.
CVE-2024-3400CRITICALbajo ataqueransomware24 abr 2024
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
100RIESGO
abrir ↗
← anteriorpágina 229 / 457siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.