Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.056 exploits
VulnCheck XDB
client-side
WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
33RIESGO
abrir ↗VulnCheck XDB
initial-access
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
63RIESGO
abrir ↗VulnCheck XDB
initial-access
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
63RIESGO
abrir ↗GitHub PoC★ 4
Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.
Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint
41RIESGO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
63RIESGO
abrir ↗GitHub PoC★ 6
A python tool to detect PDF files exploiting CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS
76RIESGO
abrir ↗GitHub PoC★ 1
Out-of-bounds Write (CWE-787)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS
76RIESGO
abrir ↗GitHub PoC
Exploitability PoC for CVE-2026-102-268 (PyJWT Asymmetric-PEM detection bypass).
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
48RIESGO
abrir ↗GitHub PoC★ 64
DirtyFrag Android Root is an Android app and helper module chain based on DirtyFrag (CVE-2026-43284). Tested on iQOO Z9 5G.
xfrm: esp: avoid in-place decrypt on shared skb frags
78RIESGO
abrir ↗GitHub PoC
Divi Membership (DiviEngine) pre-auth admin takeover — CVE-2026-19660 paypal_param bypass. Python PoC with exploit + cookie export.
Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
48RIESGO
abrir ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
48RIESGO
abrir ↗GitHub PoC★ 2
Predictable delete_code via rand() in PictShare < 3.7.1 (CWE-338). PoC + advisory writeup.
PictShare < 3.7.1 Predictable Delete Code via rand()
41RIESGO
abrir ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RIESGO
abrir ↗GitHub PoC★ 2
Sensitive info disclosure via info API in PictShare < 3.7.1 (CWE-522). PoC + advisory writeup.
PictShare < 3.7.1 Sensitive Information Disclosure via info API
41RIESGO
abrir ↗GitHub PoC
watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RIESGO
abrir ↗GitHub PoC
ShadowForge-Cyber/CVE-2026-104286-POC
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RIESGO
abrir ↗GitHub PoC★ 1
34zY/CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS
76RIESGO
abrir ↗GitHub PoC★ 1
REDCap DataImport RCE
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
63RIESGO
abrir ↗Exploit-DB
Krayin CRM 2.2.4 - IDOR
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
33RIESGO
abrir ↗GitHub PoC
CVE-2026-96349 — WordPress SiteSkite plugin ≤2.1.8 unauthenticated RCE (CVSS 10.0, CWE-94). PoCbit mass-exploit PoC: legacy API-key autologin (?token=) + REST MCP siteskite_execute_php eval chain; fixed in 2.2.0. Check/exploit/mass bulk, hits.txt & exploited.txt, --lab self-test. Catalog: https://pocbit.org/pocs/cve-2026-96349
WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability
48RIESGO
abrir ↗GitHub PoC★ 1
I like CVEs!
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RIESGO
abrir ↗GitHub PoC
Sanitized report and local PoC for CVE-2026-103584
attacker-controlled javascript license URL via XSS
28RIESGO
abrir ↗GitHub PoC
critical-severity unauthenticated Remote Code Execution (RCE) vulnerability impacting Orkes Conductor
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
63RIESGO
abrir ↗GitHub PoC
Sanitized report and local PoC for CVE-2026-103585
attacker-controlled javascript license URL via XSS
28RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.