Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
16.313 exploits
GitHub PoC★ 2
A safe read-only Linux check for CVE-2026-31431 / Copy Fail without running exploit code.
crypto: algif_aead - Revert to operating out-of-place
86RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-20182 PoC - Cisco Catalyst SD-WAN Controller / Manager Authentication Bypass (CVSS 10.0)
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
100RIESGO
abrir ↗GitHub PoC★ 1
Python exploit toolkit for WordPress Crop Image RCE — CVE-2019-8942 & CVE-2019-8943
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry ca
60RIESGO
abrir ↗GitHub PoC★ 3
eprocess offset puller for relevant member offsets and function addresses for cve-2026-40369
Windows Kernel Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC
CVE-2024-6387 POC (Currently being edited)
Openssh: regresshion - race condition in ssh allows rce/dos
63RIESGO
abrir ↗GitHub PoC
NullByte8080/CVE-2026-36228
Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execu
41RIESGO
abrir ↗GitHub PoC★ 2
Scanner: CVE-2026-9082 Drupal PostgreSQL SQLi via JSON:API — Python scanner for unauthenticated SQLi leading to RCE (CISA KEV)
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
98RIESGO
abrir ↗GitHub PoC
r3nsi15/CVE-2026-33017-langflow-rce
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
98RIESGO
abrir ↗GitHub PoC★ 2
Safely detect whether a PAN-OS target is vulnerable to CVE-2026-0265.
PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled
56RIESGO
abrir ↗GitHub PoC
CVE-2026-42208 - LiteLLM SQL Injection vulnerability scanner for BerriAI LiteLLM proxy instances
LiteLLM: SQL injection in Proxy API key verification
93RIESGO
abrir ↗GitHub PoC
felisha-elmer/Sandbox-Challenge-Spring4Shell-CVE-2022-22965-
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RIESGO
abrir ↗GitHub PoC
96613686/CVE-2026-45584
Microsoft Defender Remote Code Execution Vulnerability
41RIESGO
abrir ↗GitHub PoC★ 1
Detect whether a Strapi instance is vulnerable to CVE-2026-27886 (unauthenticated boolean-oracle exfiltration of administrator secrets).
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
63RIESGO
abrir ↗GitHub PoC
logis11/CVE-2025-55423-analysis-and-reproduction
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the contr
48RIESGO
abrir ↗GitHub PoC
The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass
Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
63RIESGO
abrir ↗GitHub PoC
This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by using any incorrect password in a Basic Authentication header. Attackers could abuse this flaw to create a new administrator account without prior authentication.
Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
63RIESGO
abrir ↗GitHub PoC
NullByte8080/CVE-2026-36226
Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensit
33RIESGO
abrir ↗GitHub PoC
A Go implementation of PinTheft (CVE-2026-43494)
net/rds: reset op_nents when zerocopy page pin fails
41RIESGO
abrir ↗GitHub PoC
Divi Form Builder <= 5.1.2 — Unauthenticated Privilege Escalation via Role Injection
Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'
48RIESGO
abrir ↗GitHub PoC
Scanner: CVE-2026-41091/45498 Microsoft Defender LPE/DoS — Python scanner for Windows Defender privilege escalation (CISA KEV)
Microsoft Defender Elevation of Privilege Vulnerability
71RIESGO
abrir ↗GitHub PoC
A Go implementation of PinTheft (CVE-2026-43494)
net/rds: reset op_nents when zerocopy page pin fails
41RIESGO
abrir ↗GitHub PoC
Proof-of-concept for CVE-2026-33017, demonstrating unauthenticated remote code execution in vulnerable Langflow versions through malicious CustomComponent code injection.
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
98RIESGO
abrir ↗GitHub PoC
NullByte8080/CVE-2026-36227
Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and e
33RIESGO
abrir ↗GitHub PoC
Docker Model Runner container-to-host RCE / Escape: A critical vulnerability that allows for container-to-host code execution in the Docker Model Runner MLX / SGLANG / VLLM inference backend.
Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends
41RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-9082 | SA-CORE-2026-004
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
98RIESGO
abrir ↗GitHub PoC★ 1
PoC for CVE-2026-9082 (Drupal SA-CORE-2026-004) Drupal Core SQLi
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
98RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.