Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.950exploits catalogados
40.798CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.343VulnCheck XDB 10.507Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.048 exploits
VulnCheck XDB
initial-access
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RIESGO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
Vulhub elasticsearch/CVE-2015-1427: Elasticsearch 1.4.2 Groovy sandbox escape, run with Isoloom
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
100RIESGO
abrir ↗VulnCheck XDB
info-leak
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗VulnCheck XDB
info-leak
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗VulnCheck XDB
info-leak
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC
Vulhub solr/CVE-2019-17558: Apache Solr Velocity Template RCE (CVE-2019-17558), run with Isoloom
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V
100RIESGO
abrir ↗GitHub PoC
Vulhub postgres/CVE-2019-9193: PostgreSQL COPY FROM PROGRAM Command Execution (CVE-2019-9193), run with Isoloom
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RIESGO
abrir ↗GitHub PoC
PoC for keycloak 1.26 vulnerability
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RIESGO
abrir ↗GitHub PoC
theendofabbys/CVE-2026-61424
Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2
48RIESGO
abrir ↗GitHub PoC
Уязвимая лаборатория WSO2 API Manager 4.5.0 в Docker, сканер и эксплойт для CVE-2026-5430 (обход аутентификации через поддельный HS256 JWT)
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RIESGO
abrir ↗GitHub PoC
Analisi e sfruttamento pratico della CVE-2026-46300 (Fragnesia) per l'ottenimento di Initial Access in un ambiente di test.
net: skbuff: preserve shared-frag marker during coalescing
91RIESGO
abrir ↗VulnCheck XDB
info-leak
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12
43RIESGO
abrir ↗VulnCheck XDB
initial-access
Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
60RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RIESGO
abrir ↗GitHub PoC
Vulhub openssh/CVE-2018-15473: OpenSSH 7.7 Username Enumeration (CVE-2018-15473), run with Isoloom
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RIESGO
abrir ↗GitHub PoC★ 1
Detection PoC for CVE-2026-5430 — unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0–4.6.0. Read-only assessment tool with patch confirmation and WAF detection. Authorized use only.
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RIESGO
abrir ↗GitHub PoC
a proof of concept for the apache log4j Java logging library (CVE-2021-44228 vulnerability)
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
theendofabbys/CVE-2026-48907
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗VulnCheck XDB
local
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗GitHub PoC
Case study: pyLoad CVE-2023-0297 (Click'n'Load jk evaluated by Js2Py). Demo only, not for use.
Code Injection in pyload/pyload
85RIESGO
abrir ↗GitHub PoC
CVE-2026-59358 - Cloud Foundry UAA - High - Remote - Privilege leftover - user PKCE token as client_credentials Bearer
UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
41RIESGO
abrir ↗GitHub PoC★ 7
CVE-2026-21589 detector for Atlassian Data Center webresource traversal. Pre-auth webroot file read confirm for Jira, Confluence and Bitbucket.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC
Benign, offline reproduction of CVE-2026-93355 — LiteLLM unverified-email JWT account takeover (runs LiteLLM's real code)
LiteLLM Weak JWT Authentication via Email-Based User Lookup
41RIESGO
abrir ↗GitHub PoC
DOS infinite-loop Vulnerability POC
iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
41RIESGO
abrir ↗GitHub PoC★ 1
cve-2026-87902 lab
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RIESGO
abrir ↗GitHub PoC
CVE-2026-102422 POC
shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
48RIESGO
abrir ↗GitHub PoC
Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce
Undisclosed RCE in Zammad v6.3 and higher
83RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.