Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.031exploits catalogados
39.530CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.309VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
16.309 exploits
GitHub PoC★ 10
Public advisory for CVE-2025-65640: Stored XSS vulnerability in Globe Document Intelligence.
Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.
33RIESGO
abrir ↗GitHub PoC★ 1
funixone/EXPLOIT-CVE-2026-8832
WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost
41RIESGO
abrir ↗GitHub PoC
rootdirective-sec/CVE-2026-47100-Analysis-Lab
Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX
41RIESGO
abrir ↗GitHub PoC
muslimbek-0x/CVE-2026-48030
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)
63RIESGO
abrir ↗GitHub PoC★ 1
Full walkthrough of HTB's Reactor machine — exploit CVE-2025-55182 to gain a shell, then get root via an exposed Node.js debugger. Step-by-step with screenshots.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
A Marp slide deck about CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RIESGO
abrir ↗GitHub PoC
This script safely checks the local version of the LiteSpeed cPanel plugin to determine if the system is running a version vulnerable to CVE-2026-48172. It does not send exploits or interact with network endpoints maliciously.
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i
78RIESGO
abrir ↗GitHub PoC★ 1
Intentionally-vulnerable nginx 1.30.0 CVE lab images (CVE-2026-40701/42934/42945/42946) for isolated security research. Lab use only.
NGINX ngx_http_ssl_module vulnerability
33RIESGO
abrir ↗GitHub PoC
CVE-2026-8380
Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion
33RIESGO
abrir ↗GitHub PoC
Security advisories / CVE references for osTicket 1.18.3 (CVE-2026-38444, 38446, 38447)
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is
33RIESGO
abrir ↗GitHub PoC
aarch64 and x64 python POC
crypto: algif_aead - Revert to operating out-of-place
86RIESGO
abrir ↗GitHub PoC★ 2
W5M1n9/NGINX-ngx_http_rewrite_module-heap-buffer-overflow-CVE-2026-9256
NGINX ngx_http_rewrite_module vulnerability
48RIESGO
abrir ↗GitHub PoC★ 1
Detection scanner for CVE-2026-48710 - Host-header auth bypass in Starlette/FastAPI
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
78RIESGO
abrir ↗GitHub PoC
EXPLOIT CVE-2026-8832
WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost
41RIESGO
abrir ↗GitHub PoC
POC for CVE-2026-49009, an authenticated path traversal to RCE issue in Mender Server.
Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.
28RIESGO
abrir ↗GitHub PoC
Isolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059)
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RIESGO
abrir ↗GitHub PoC
Black-box web application penetration test of BadStore e-commerce platform. Covers SQL injection, CVE-2006-3918, HTTP request manipulation, OSINT-driven spear phishing, and MITRE ATT&CK-mapped findings.
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before
45RIESGO
abrir ↗GitHub PoC★ 1
Full walkthrough of HTB's Reactor machine — exploit CVE-2025-55182 to gain a shell, then get root via an exposed Node.js debugger. Step-by-step with screenshots.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
Isolated AD/Linux attack lab: exploited CVE-2007-2447 via Metasploit, detected with Wazuh SIEM mapped to MITRE ATT&CK (T1190, T1059)
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RIESGO
abrir ↗GitHub PoC★ 7
Gogs RCE via argument injection in git rebase (CWE-88) — Python PoC. CVE-2026-52806
Gogs: RCE via git rebase --exec argument injection in pull request merge
63RIESGO
abrir ↗GitHub PoC★ 1
A x86_64 ASM implementation of PinTheft (CVE-2026-43494)
net/rds: reset op_nents when zerocopy page pin fails
41RIESGO
abrir ↗GitHub PoC
CVE-2026-35616 - Draft
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta
93RIESGO
abrir ↗GitHub PoC
CVE-2023-26083-Mali-InfoLeak-PoC
Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost
58RIESGO
abrir ↗GitHub PoC
Spring4Shell (CVE-2022-22965) 漏洞環境搭建與 CTF 題目
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RIESGO
abrir ↗GitHub PoC
CVE-2026-45659 Microsoft SharePoint Server Deserialization RCE.
Microsoft SharePoint Remote Code Execution Vulnerability
71RIESGO
abrir ↗GitHub PoC
CVE-2026-27771
Gitea Composer package source links use insufficient permission checks
56RIESGO
abrir ↗GitHub PoC★ 1
Starlette Host-Header URL Confusion Lab (X41-2026-002) - CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
78RIESGO
abrir ↗GitHub PoC
SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough
Windows OLE Remote Code Execution Vulnerability
70RIESGO
abrir ↗GitHub PoC
Passive checker for CVE-2026-9082 / SA-CORE-2026-004 (Drupal core SQL injection, PostgreSQL)
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
98RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.