Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.853exploits catalogados
39.383CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
16.269 exploits
GitHub PoC
CVE-2026-45067 - Draft
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
33RIESGO
abrir ↗GitHub PoC
Running OWASP cve-lite-cli against the pi monorepo: scan journey and key finding (vitest CVE-2026-47429).
Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
48RIESGO
abrir ↗GitHub PoC★ 1
Insert PHP Plugin PHP Code Injection
WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API
48RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-48595
Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects
21RIESGO
abrir ↗GitHub PoC
carlosalbertotuma/cve-2026-3180-poc
Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-50751
User Authentication Bypass in VPN Remote Access and Mobile Access
100RIESGO
abrir ↗GitHub PoC
CVE-2023-21716 - Microsoft Word RTF fonttbl Heap Corruption RCE exploit with reverse shell payload
Microsoft Word Remote Code Execution Vulnerability
70RIESGO
abrir ↗GitHub PoC★ 1
smb spooler to RCE
Samba: samba: remote code execution in printing subsystem via unescaped job description
68RIESGO
abrir ↗GitHub PoC
GNU-InetUtils-telnetd-Authentication-Bypass-Vulnerability
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗GitHub PoC★ 3
A PoC exploit for CVE-2026-24061 - GNU InetUtils telnetd Argument Injection Authentication Bypass
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗GitHub PoC
willygailo/WG-CVE-2026-1555-Linux
WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload
48RIESGO
abrir ↗GitHub PoC
Based on the original version:https://github.com/vulhub/vulhub/blob/master/erlang/CVE-2025-32433/exploit.py Replace Unicode checkmark with ASCII character for Windows compatibility
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RIESGO
abrir ↗GitHub PoC★ 2
Disclosed on June 3, 2026, the "HTTP/2 Bomb" is an unauthenticated remote DoS that combines an HPACK compression bomb with a Slowloris-style hold to exhaust server memory. It affects default HTTP/2 configurations of **nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora**.
Apache HTTP Server: mod_http2 denial of service
41RIESGO
abrir ↗GitHub PoC★ 1
Mitigation scripts for CVE-2026-50751
User Authentication Bypass in VPN Remote Access and Mobile Access
100RIESGO
abrir ↗GitHub PoC★ 2
Account takeover full PoC for CVE-2026-27886 in Strapi CMS
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
63RIESGO
abrir ↗GitHub PoC
rootdirective-sec/CVE-2026-7465-Lab
Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
41RIESGO
abrir ↗GitHub PoC
Python tool for analyzing CVE-2018-16763 in FUEL CMS with cleaner response parsing and interactive vulnerability checking.
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RIESGO
abrir ↗GitHub PoC
Exploitability PoC for CVE-2026-43512 (Apache Tomcat Digest Authentication Bypass)
Apache Tomcat: Digest authenticator will authenticate any unknown user
48RIESGO
abrir ↗GitHub PoC
YellowKey | BitLocker Bypass CVE-2026-45585 | Detect & Fix Automatically via Microsoft Intune
Windows BitLocker Security Feature Bypass Vulnerability
33RIESGO
abrir ↗GitHub PoC★ 1
Unauthenticated SQL Injection to Remote Code Execution in FreePBX — CVE-2025-57819
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗GitHub PoC★ 1
Exploit CVE-2026-4480
Samba: samba: remote code execution in printing subsystem via unescaped job description
68RIESGO
abrir ↗GitHub PoC★ 2
FreePBX Pre-Auth SQLi to RCE (CVE-2025-57819) — All-in-One Exploit
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗GitHub PoC
Unauthenticated SQL injection in FreePBX Endpoint Manager (CVE-2025-57819) that injects a cron-scheduled PHP webshell for remote code execution.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗GitHub PoC
Drupal Core PostgreSQL SQLi to RCE via /user/login (CVE-2026-9082 / SA-CORE-2026-004)
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
98RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-4480
Samba: samba: remote code execution in printing subsystem via unescaped job description
68RIESGO
abrir ↗GitHub PoC
m0nk3ygod/CVE-2026-34040-PoC
Moby: AuthZ plugin bypass with oversized request body
41RIESGO
abrir ↗GitHub PoC
TechWithOrgito/CVE-2025-55182-Researching-process
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
Apache ActiveMQ RCE via Jolokia vulnerability analysis and reproduction notes
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
91RIESGO
abrir ↗GitHub PoC★ 7
CVE-2025-57819 -> rce
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.