Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados

39.531CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientes populares riesgo

16.313 exploits

GitHub PoC

Multi-language PoC (Python · Go · JS · C) and technical documentation for CVE-2025-63353, a critical predictable-default-PSK vulnerability in FiberHome HG6145F1 GPON ONT devices.

CVE-2025-63353CRITICAL25 may 2026

A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-s

48RIESGO

GitHub PoC

EthanEvans92/CVE-2025-32463

CVE-2025-32463CRITICALbajo ataque25 may 2026

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

GitHub PoC★ 45

PoC for CVE-2026-28990, an ImageIO bug patched in iOS/macOS 26.5

CVE-2026-28990HIGH25 may 2026

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 a

41RIESGO

GitHub PoC

CVE-2026-38427 — Integer Wraparound → Heap Buffer Overflow in Tasmota fetch_jpg() uint16_t (Tasmota <= 15.3.0.3)

CVE-2026-38427HIGH25 may 2026

An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffe

41RIESGO

GitHub PoC

This is POC repo for CVE-2026-48208

CVE-2026-48208MEDIUM25 may 2026

Denial-of-Service via SVG Rendering in Ticket

33RIESGO

GitHub PoC

Complete CosmicSting (CVE-2024-34102) exploit suite for Magento/Adobe Commerce XXE vulnerability

CVE-2024-34102CRITICALbajo ataque25 may 2026

XXE can expose crypt key and other secrets granting full admin access

100RIESGO

GitHub PoC

CVE-2026-38426 — strcpy() Stack Buffer Overflow in Tasmota fetch_jpg() boundary[40] (Tasmota <= 15.3.0.3)

CVE-2026-38426HIGH25 may 2026

Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary cod

41RIESGO

GitHub PoC

CVE-2026-38422 — Remote Code Execution via Combined Buffer Overflows in Tasmota fetch_jpg() (Tasmota <= 15.3.0.3)

CVE-2026-38422HIGH25 may 2026

Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary cod

41RIESGO

GitHub PoC

CVE-2026-33712 - Typebot <= 3.15.2 Unauthenticated SSRF via isolated-vm sandbox fetch

CVE-2026-33712CRITICAL25 may 2026

TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls

48RIESGO

GitHub PoC★ 6

CVE-2025-55182 Exploit Tool – Python 2.7 exploit for Next.js prototype pollution leading to RCE

CVE-2025-55182CRITICALbajo ataqueransomware25 may 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

This is POC repo for CVE-2026-48188

CVE-2026-48188CRITICAL25 may 2026

SQL Injection via MySQL Quote Method

48RIESGO

GitHub PoC★ 5

CVE-2026-42945 NGINX 堆溢出漏洞扫描与验证工具

CVE-2026-42945CRITICAL25 may 2026

NGINX ngx_http_rewrite_module vulnerability

48RIESGO

GitHub PoC

Lab detection exercise for DirtyFrag (CVE-2026-43284) - Linux kernel privilege escalation via xfrm-ESP page cache corruption. Full write-up covering exploit execution, detection gaps, and corrected EQL rules using Elastic Stack

CVE-2026-43284HIGH24 may 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

GitHub PoC★ 2

copy_fail:CVE-2026-31431

CVE-2026-31431HIGHbajo ataque24 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

GitHub PoC★ 1

Local Privilege Escalation in Amazon WorkSpaces via TOCTOU and Arbitrary File Write

CVE-2026-7791HIGH24 may 2026

Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpace

41RIESGO

GitHub PoC★ 3

CVE-2026-41096: Heap Overflow in the Windows DNS Client

CVE-2026-41096CRITICAL24 may 2026

Windows DNS Client Remote Code Execution Vulnerability

48RIESGO

GitHub PoC★ 1

Automated scanner & post-exploitation toolkit for CVE-2026-41940 — cPanel & WHM root authentication bypass via session-file CRLF injection

CVE-2026-41940CRITICALbajo ataqueransomware24 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC

Ambiente Docker para demonstração prática da CVE-2025-54236 (SessionReaper): PHP Object Deserialization levando a RCE em Magento Open Source 2.4.7

CVE-2025-54236CRITICALbajo ataque24 may 2026

Adobe Commerce | Improper Input Validation (CWE-20)

100RIESGO

GitHub PoC

Tracking the nginx CVE-2026-9256 rewrite-module heap overflow

CVE-2026-9256CRITICAL24 may 2026

NGINX ngx_http_rewrite_module vulnerability

48RIESGO

GitHub PoC

mein-0/cve-2026-29923

CVE-2026-29923HIGH24 may 2026

The pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate privileges to SYSTEM via a

41RIESGO

GitHub PoC

CVE-2026-20182

CVE-2026-20182CRITICALbajo ataque24 may 2026

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

100RIESGO

GitHub PoC★ 8

Drupal CVE-2026-9082 Blind SQL Injection Checker

CVE-2026-9082CRITICALbajo ataque24 may 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

98RIESGO

GitHub PoC★ 5

CVE-2026-39987 Exploitation Tool - Marimo < 0.23.0 Pre-Auth RCE (WebSocket)

CVE-2026-39987CRITICALbajo ataque24 may 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

GitHub PoC★ 38

windows api bug

CVE-2026-41096CRITICAL24 may 2026

Windows DNS Client Remote Code Execution Vulnerability

48RIESGO

GitHub PoC

🎓 PoC Educativo para CVE-2026-23520. Laboratorio de análisis de vulnerabilidades y mitigación controlada. 🧪

CVE-2026-23520CRITICAL24 may 2026

Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE

48RIESGO

GitHub PoC

CMS Made Simple CVE-2019-9053 Exploit (Python 3)

CVE-2019-9053—24 may 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RIESGO

GitHub PoC★ 2

CVE-2025-55182 — Unauthenticated RCE in React Server Components (React2Shell). CVSS 10.0 exploit tool for authorized penetration testing.

CVE-2025-55182CRITICALbajo ataqueransomware24 may 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

w3nch/CVE-2025-55182-in-go

CVE-2025-55182CRITICALbajo ataqueransomware24 may 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

CVE-2025-47812 Poc for wingdata HTB

CVE-2025-47812CRITICALbajo ataque24 may 2026

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o

100RIESGO

GitHub PoC★ 4

BitLocker TPM+PIN Hardening Against CVE-2026-45585 (YellowKey)

CVE-2026-45585MEDIUM24 may 2026

Windows BitLocker Security Feature Bypass Vulnerability

33RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.