Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.056 exploits
GitHub PoC★ 1
CVE-2026-62062 - WordPress - Elementor Website Builder - High 8.8 - Unauthenticated POST /?rest_route=/wp/v2/users&x=elementor... - Cross-Site Request Forgery to Administrator Account Creation
WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
41RIESGO
abrir ↗GitHub PoC
LetsDefend SOC lab investigating CVE-2024-49138 exploitation and related malicious activity.
Windows Common Log File System Driver Elevation of Privilege Vulnerability
76RIESGO
abrir ↗VulnCheck XDB
client-side
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RIESGO
abrir ↗GitHub PoC
rmhowe425/POC-CVE-2026-110200
Langflow OSS is affected by multiple vulnerabilities
33RIESGO
abrir ↗GitHub PoC
rmhowe425/POC-CVE-2026-107329
Langflow OSS is affected by multiple vulnerabilities
48RIESGO
abrir ↗GitHub PoC
rmhowe425/POC-CVE-2026-107328
Langflow OSS is affected by multiple vulnerabilities
48RIESGO
abrir ↗GitHub PoC
rmhowe425/POC-CVE-2026-107326
Langflow OSS is affected by multiple vulnerabilities
41RIESGO
abrir ↗GitHub PoC
Lab vulnerável (Docker) + PoC Python para a CVE-2026-87902 — path traversal não autenticado no WordPress Core (page-template -> LFI -> RCE condicional). Uso educacional/autorizado.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RIESGO
abrir ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RIESGO
abrir ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query
41RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
SSH user impersonation possible in Mikrotik RouterOS
48RIESGO
abrir ↗GitHub PoC
Benign, self-contained reproduction of CVE-2026-61732 (Decepticon ChatML role-boundary forgery)
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
48RIESGO
abrir ↗VulnCheck XDB
initial-access
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
63RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
70RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗GitHub PoC★ 6
CVE-2026-59310-POC 仅用于自测，请勿用于攻击
vCenter directory-traversal vulnerability
90RIESGO
abrir ↗GitHub PoC
CVE-2026-96512 - sudo - High 7.8 - Authenticated LOCAL TZ=UTC+14 sudo -n /usr/bin/id - Local Privilege Escalation via Time-Window Bypass
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
41RIESGO
abrir ↗GitHub PoC
Proof of concept for vulnerability CVE-2026-87902 in Wordpress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RIESGO
abrir ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RIESGO
abrir ↗GitHub PoC
Ermensonx/sudotimewarp-cve-2026-96512-
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
41RIESGO
abrir ↗GitHub PoC
WP Plainview Activity Monitor auth RCE fix: broken manual cookie parse to stable Session handling. CVE-2018-15877 educational fix.
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta
60RIESGO
abrir ↗GitHub PoC★ 4
Unauthenticated privilege escalation in WordPress WAWP (Automation Web Platform) ≤ 4.8.6 via public REST signup and unsanitized wawp_custom_fields → admin. Python check/exploit PoC (PoCbit).
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
48RIESGO
abrir ↗GitHub PoC★ 8
CVE-2026-59310-POC 仅用于自测，请勿用于攻击
vCenter directory-traversal vulnerability
90RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.