Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.034exploits catalogados

39.531CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.557Exploit-DB 24.485GitHub PoC 16.312VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientes populares riesgo

16.313 exploits

GitHub PoC

This exploit is based on CVE-2019-6340 and was built upon the original exploit by leonjza and the Metasploit module, extending it can be executed multiple times against the same target without waiting for cache expiration.

CVE-2019-6340HIGHbajo ataque27 may 2026

Drupal core - Highly critical - Remote Code Execution

100RIESGO

GitHub PoC

thinhap/CVE-2026-9082-PoC

CVE-2026-9082CRITICALbajo ataque27 may 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

98RIESGO

GitHub PoC

0x00phantom-hat/Hoverfly-1.11.3-RCE-CVE-2025-54123-Exploit

CVE-2025-54123CRITICAL27 may 2026

Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

68RIESGO

GitHub PoC

CVE-2026-27771

CVE-2026-27771HIGH27 may 2026

Gitea Composer package source links use insufficient permission checks

56RIESGO

GitHub PoC

this is a study about CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)

CVE-2021-3156HIGHbajo ataque27 may 2026

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

GitHub PoC

hadhub/CVE-2026-49344-Mercator-JSON-DSL

CVE-2026-49344HIGH27 may 2026

Mercator has a Personal Identifiable Information Leak from Query Executor feature

21RIESGO

GitHub PoC

SSRF Discovered in Mercator

CVE-2026-49345MEDIUM27 may 2026

Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)

13RIESGO

GitHub PoC

lwd3c/CVE-2026-47342

CVE-2026-47342HIGH27 may 2026

Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass

21RIESGO

GitHub PoC

Dungsocool/CVE-2017-10271

CVE-2017-10271HIGHbajo ataqueransomware27 may 2026

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RIESGO

GitHub PoC★ 1

Starlette Host-Header URL Confusion Lab (X41-2026-002) - CVE-2026-48710

CVE-2026-48710MEDIUMbajo ataque27 may 2026

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

78RIESGO

GitHub PoC★ 1

mein-0/cve-2026-0828

CVE-2026-0828HIGH27 may 2026

Kernel driver vulnerability in Safetica Endpoint Client

41RIESGO

GitHub PoC

Lab 3: Supervisord XML-RPC Remote Code Execution (CVE-2017-11610) - Writeup and Exploit

CVE-2017-11610—27 may 2026

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows rem

60RIESGO

GitHub PoC

CVE-2026-5172: buffer overflow in extract_addresses() on crafted resource record PoC

CVE-2026-5172HIGH27 may 2026

CVE-2026-5172

41RIESGO

GitHub PoC

Spring4Shell (CVE-2022-22965) 漏洞環境搭建與 CTF 題目

CVE-2022-22965CRITICALbajo ataque27 may 2026

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

GitHub PoC

Description

CVE-2022-22965CRITICALbajo ataque27 may 2026

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

GitHub PoC★ 3

Ghost Content API SQL Injection

CVE-2026-26980CRITICAL27 may 2026

Ghost has a SQL Injection in its Content API

63RIESGO

GitHub PoC

CVE-2021-3560 — Polkit privilege escalation exploit via accounts-daemon D-Bus race condition

CVE-2021-3560HIGHbajo ataque27 may 2026

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RIESGO

GitHub PoC

Generate the poc for CVE-2026-4893: broken EDNS Client Subnet validation.

CVE-2026-4893MEDIUM27 may 2026

CVE-2026-4893

33RIESGO

GitHub PoC★ 1

CVE-2026-45659

CVE-2026-45659HIGHbajo ataqueransomware27 may 2026

Microsoft SharePoint Remote Code Execution Vulnerability

71RIESGO

GitHub PoC

Passive checker for CVE-2026-9082 / SA-CORE-2026-004 (Drupal core SQL injection, PostgreSQL)

CVE-2026-9082CRITICALbajo ataque27 may 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

98RIESGO

GitHub PoC★ 20

CVE-2026-27771 - Gitea/Forgejo Container Registry Auth Bypass Exploit PoC - Pull private container images without authentication

CVE-2026-27771HIGH27 may 2026

Gitea Composer package source links use insufficient permission checks

56RIESGO

GitHub PoC★ 2

⚠️ DISCLAIMER: This tool is intended for authorized penetration testing and educational purposes only. Using this tool against systems without explicit written permission is illegal. The developers are not responsible for any misuse or damage caused.

CVE-2026-41940CRITICALbajo ataqueransomware27 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC

SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough

CVE-2025-21298CRITICAL27 may 2026

Windows OLE Remote Code Execution Vulnerability

70RIESGO

GitHub PoC

Dungsocool/CVE-2017-5638

CVE-2017-5638CRITICALbajo ataqueransomware26 may 2026

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

GitHub PoC★ 2

Proof-of-concept for CVE-2026-43284 — 4-byte XFRM/ESP page-cache write primitive to patch a setuid binary (x86_64, user namespaces). Includes kernel preflight + SUID scan.

CVE-2026-43284HIGH26 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

GitHub PoC

Educational lab demonstrating CVE-2025-55182: Critical RCE in React Server Components via prototype pollution in the Flight protocol

CVE-2025-55182CRITICALbajo ataqueransomware26 may 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

xxconi/CVE-2026-6271

CVE-2026-6271CRITICAL26 may 2026

Career Section <= 1.7 - Unauthenticated Arbitrary File Upload

48RIESGO

GitHub PoC★ 1

Cisco Catalyst SD-WAN Peering Authentication Bypass

CVE-2026-20182CRITICALbajo ataque26 may 2026

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

100RIESGO

GitHub PoC

CVE-2026-3296 is a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the Everest Forms WordPress plugin

CVE-2026-3296CRITICAL26 may 2026

Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata

63RIESGO

GitHub PoC

CVE-2026-6741 is a CVSS 8.8 (High) Authenticated (Agent+) Privilege Escalation vulnerability in the LatePoint – Calendar Booking Plugin

CVE-2026-6741HIGH26 may 2026

LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.