Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.553exploits catalogados
39.165CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.281Exploit-DB 24.485GitHub PoC 16.152VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientespopularesriesgo
16.153 exploits
GitHub PoC
ShadowForge-Cyber/CVE-2026-104286-POC
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RIESGO
abrir ↗GitHub PoC
NetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772, CVE-2026-88779
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RIESGO
abrir ↗GitHub PoC★ 2
VC-Strike — VMware vCenter CVE-2026-59310 (unauth root RCE) & CVE-2026-59309 (SRP auth bypass) authorized pentest suite. GUI+CLI, multi-session C2, stdlib-only. 授权测试专用
vCenter directory-traversal vulnerability
78RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-90907 (CVSS 6.9) — Joomla! CMS unauthorized user account creation via com_users profile.save (authorization bypass). Non-destructive checker + authorized-use exploit PoC. Fixed in 5.4.9 / 6.1.4.
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
33RIESGO
abrir ↗GitHub PoC
34zY/CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RIESGO
abrir ↗GitHub PoC
Hassham1/CVE-2026-62059-ultimate-member-sqli-poc
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
41RIESGO
abrir ↗GitHub PoC
a practical NetScaler CTX697096 security-assessment workflow covering exposure validation, upgrade readiness and compromise-indicator hunting for CVE-2026-88771 through CVE-2026-88778.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RIESGO
abrir ↗GitHub PoC
critical-severity unauthenticated Remote Code Execution (RCE) vulnerability impacting Orkes Conductor
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
68RIESGO
abrir ↗GitHub PoC
CVE-2026-102425 - GUI CONSOLE
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
48RIESGO
abrir ↗GitHub PoC★ 9
Runtime exploit monitor for Apple document/image pipelines (iOS/macOS) — EXPMON concept: Frida agent + behavioral rules. First target: the CVE-2026-86950 glyph chain.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RIESGO
abrir ↗GitHub PoC
PitScaler: independent, source-linked briefing on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 (CTX697096). https://pitscaler.com
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RIESGO
abrir ↗GitHub PoC★ 2
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Satori-generated SVG has improper escaping
33RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RIESGO
abrir ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103442
MergeAccount PHP object injection via session-key substitution
41RIESGO
abrir ↗GitHub PoC
Authlib 1.7.2: Signature Verification Bypass - General JSON JWS Accepts Unsigned Payload when `signatures` is Empty
Authlib library contains a signature‑verification bypass vulnerability
48RIESGO
abrir ↗GitHub PoC
single PoC for CVE-2026-18143 Unauth AFU (Arbitrary File Upload)
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
48RIESGO
abrir ↗GitHub PoC
CVE-2026-102425 PoC (PoCbit) — Joomla Balbooa Forms (com_baforms) <2.4.3.4 unauth RCE via field shortcode injection in post-submission PHP eval(). check + exploit + mass bulk. https://pocbit.org/pocs/cve-2026-102425
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
48RIESGO
abrir ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103445
Stored XSS through PageForms #autoedit redirect links
28RIESGO
abrir ↗GitHub PoC★ 1
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Satori-generated SVG has improper escaping
33RIESGO
abrir ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103446
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
41RIESGO
abrir ↗GitHub PoC
CVE-2026-76570 PoC (PoCbit) — Joomla JCTables (com_jctables) <1.21.1: unauth SQL read/write via front-end JSON API getdatarow/getrow (CVSS 4.0 10.0 AT:N). check + exploit + mass. https://www.cve.org/CVERecord?id=CVE-2026-76570
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
48RIESGO
abrir ↗GitHub PoC★ 2
EUVD-2026-89950 Improper Handling of URL Encoding (Hex Encoding) (CWE-177)
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
78RIESGO
abrir ↗GitHub PoC
JailBr3ak/CVE-2026-97347
Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
41RIESGO
abrir ↗GitHub PoC
Local classroom demo of NoSQL operator injection in LangGraph's MongoDBSaver (GHSA-98xf-r82g-9mhx / CVE-2026-48121). Fictional data only.
@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
33RIESGO
abrir ↗GitHub PoC
kikozz/CVE-2013-3660-win32k.sys
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windo
98RIESGO
abrir ↗GitHub PoC
Security PoC payload host for CVE-2026-91159 oEmbed test (authorized bug bounty)
Discourse: Stored oEmbed HTML injection via allowed iframe
38RIESGO
abrir ↗GitHub PoC
Amoru-Bek/CVE-2025-59528-Poc
Flowise has Remote Code Execution vulnerability
85RIESGO
abrir ↗GitHub PoC
CVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
63RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.