Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.950exploits catalogados
40.798CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.343VulnCheck XDB 10.507Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.950 exploits
VulnCheck XDB
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RIESGO
abrir ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RIESGO
abrir ↗GitHub PoC
Vulhub libssh/CVE-2018-10933: libssh Server Authentication Bypass (CVE-2018-10933), run with Isoloom
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RIESGO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
56RIESGO
abrir ↗GitHub PoC★ 1
Defensive security checker for Citrix NetScaler ADC & Gateway — CVE-2026-88771 through CVE-2026-88778
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RIESGO
abrir ↗GitHub PoC
Vulhub nginx/CVE-2013-4547: Nginx Filename Logic Vulnerability (CVE-2013-4547), run with Isoloom
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
35RIESGO
abrir ↗VulnCheck XDB
initial-access
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RIESGO
abrir ↗VulnCheck XDB
initial-access
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RIESGO
abrir ↗GitHub PoC
CVE-2026-102422 POC
shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
48RIESGO
abrir ↗GitHub PoC
0xCyp1337/CVE-2026-81780
WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
48RIESGO
abrir ↗GitHub PoC
CVE-2021-38759 — Raspberry Pi OS Default Credentials Exploit
Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain a
28RIESGO
abrir ↗GitHub PoC
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗VulnCheck XDB
denial-of-service
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a
76RIESGO
abrir ↗GitHub PoC
DOS infinite-loop Vulnerability POC
iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
41RIESGO
abrir ↗GitHub PoC★ 1
cve-2026-87902 lab
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RIESGO
abrir ↗GitHub PoC
CVE-2026-59358 - Cloud Foundry UAA - High - Remote - Privilege leftover - user PKCE token as client_credentials Bearer
UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
41RIESGO
abrir ↗GitHub PoC
Benign, offline reproduction of CVE-2026-93355 — LiteLLM unverified-email JWT account takeover (runs LiteLLM's real code)
LiteLLM Weak JWT Authentication via Email-Based User Lookup
41RIESGO
abrir ↗GitHub PoC
Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce
Undisclosed RCE in Zammad v6.3 and higher
83RIESGO
abrir ↗GitHub PoC
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC
Case study: pyLoad CVE-2023-0297 (Click'n'Load jk evaluated by Js2Py). Demo only, not for use.
Code Injection in pyload/pyload
85RIESGO
abrir ↗GitHub PoC★ 7
CVE-2026-21589 detector for Atlassian Data Center webresource traversal. Pre-auth webroot file read confirm for Jira, Confluence and Bitbucket.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC
Case study: Label Studio CVE-2022-36551 (task-import URL opened with urlopen). Demo only, not for use.
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.
23RIESGO
abrir ↗GitHub PoC★ 1
Smarty is vulnerable to code injection through template inheritance. Crafted assigned data can inject a forged SmartyNocache marker into regenerated PHP cache files, potentially allowing attackers to execute arbitrary PHP code. The issue affects Smarty 4.5.7 and earlier, and 5.8.4 and earlier.
Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
48RIESGO
abrir ↗VulnCheck XDB
initial-access
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗GitHub PoC
在AI辅助下利用cve-2019-2215 完成OPPO A77t提权
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗GitHub PoC
Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.