Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.052exploits catalogados
40.803CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.347VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.052 exploits
GitHub PoC
BimBoxH4/CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC★ 4
Privilege Escalation vulnerability
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
41RIESGO
abrir ↗GitHub PoC
MCPJam Inspector Remote Code Execution
REC in MCPJam inspector due to HTTP Endpoint exposes
75RIESGO
abrir ↗VulnCheck XDB
initial-access
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗VulnCheck XDB
info-leak
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗VulnCheck XDB
info-leak
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC★ 4
Independent PoC and reproducible lab for CVE-2026-97332 — User Private Files < 2.2.0 unauthenticated private file disclosure on WordPress Multisite.
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
33RIESGO
abrir ↗GitHub PoC
Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
33RIESGO
abrir ↗VulnCheck XDB
info-leak
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC
Atlassian Arbitrary File Read
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗VulnCheck XDB
local
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗GitHub PoC
DirtyFrag CVE-2026-43284 research for 5.4-qgki devices
xfrm: esp: avoid in-place decrypt on shared skb frags
78RIESGO
abrir ↗VulnCheck XDB
initial-access
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
100RIESGO
abrir ↗GitHub PoC★ 1
Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN
Improper Certificate Validation in Quantum Security Gateway
90RIESGO
abrir ↗VulnCheck XDB
local
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio
76RIESGO
abrir ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RIESGO
abrir ↗GitHub PoC
在AI辅助下利用cve-2019-2215 完成OPPO A77t提权
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗GitHub PoC
CVE-2021-38759 — Raspberry Pi OS Default Credentials Exploit
Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain a
28RIESGO
abrir ↗GitHub PoC★ 179
CVE-2026-63030 + CVE-2026-60137 exploit RCE chain
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗VulnCheck XDB
denial-of-service
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a
76RIESGO
abrir ↗GitHub PoC
Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce
Undisclosed RCE in Zammad v6.3 and higher
83RIESGO
abrir ↗GitHub PoC
CVE-2026-102422 POC
shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
48RIESGO
abrir ↗GitHub PoC
Benign, offline reproduction of CVE-2026-93355 — LiteLLM unverified-email JWT account takeover (runs LiteLLM's real code)
LiteLLM Weak JWT Authentication via Email-Based User Lookup
41RIESGO
abrir ↗GitHub PoC★ 1
cve-2026-87902 lab
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RIESGO
abrir ↗GitHub PoC
DOS infinite-loop Vulnerability POC
iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
41RIESGO
abrir ↗GitHub PoC★ 4
CVE-2026-13043 - Exploiting Panda / WatchGuard pskmad.sys authentication bypass for privileged IOCTL access, MSR disclosure and arbitrary process memory reads.
WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access
48RIESGO
abrir ↗GitHub PoC
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC
Case study: pyLoad CVE-2023-0297 (Click'n'Load jk evaluated by Js2Py). Demo only, not for use.
Code Injection in pyload/pyload
85RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.