Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.056 exploits
GitHub PoC★ 2
Unauth REDCap RCE (CVE-2026-90817) mass check PoC — requires public survey hash for full validation.
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
63RIESGO
abrir ↗VulnCheck XDB
initial-access
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
63RIESGO
abrir ↗GitHub PoC
suominen/CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
71RIESGO
abrir ↗GitHub PoC★ 23
DJI Drone DUML Command Injection over Bluetooth — Proof of Concept for CVE-2026-78306
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
41RIESGO
abrir ↗GitHub PoC★ 2
D-Link R95 (BE9500) DHMAPI SetTimeSettings command injection -> root RCE PoC (CVE-2026-93958); for authorized testing
D-Link R95 DHMAPI ssi system os command injection
48RIESGO
abrir ↗GitHub PoC
CVE-2021-43798 Grafana Unauthenticated Path Traversal - Security Lab | Shivam Gupta | 23104003
Grafana path traversal
100RIESGO
abrir ↗GitHub PoC
CVE-2026-36213: MEmu Android Emulator 9.2.7.0 Local Privilege Escalation
An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.e
41RIESGO
abrir ↗GitHub PoC
mfahdk/CVE-2026-39987_RCE_PoC
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RIESGO
abrir ↗GitHub PoC
ZTE SmartLife security findings leading to account takeover: 100K+ Google Play downloads and CVE-2026-86552 through CVE-2026-86555.
A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
33RIESGO
abrir ↗GitHub PoC★ 7
Proof-of-concept and instrumented reproduction harness for CVE-2026-28609, an out-of-bounds write in Android's MatroskaExtractor reachable via a crafted WebM file with a big-endian PCM audio track.
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to re
41RIESGO
abrir ↗GitHub PoC
CVE-2026-36213: MEmu Android Emulator 9.2.7.0 Local Privilege Escalation
An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.e
41RIESGO
abrir ↗GitHub PoC★ 5
DJI Drone Cleartext Bluetooth Transmission of Wi-Fi PSK and Session UUID — Proof of Concept for CVE-2026-77812.
Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE
48RIESGO
abrir ↗VulnCheck XDB
initial-access
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RIESGO
abrir ↗GitHub PoC
A PoC for CVE-2026-71217
Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion
41RIESGO
abrir ↗VulnCheck XDB
info-leak
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RIESGO
abrir ↗GitHub PoC
Unauthenticated Arbitrary Shortcode Execution
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
48RIESGO
abrir ↗GitHub PoC
shambhaviM18/cve-2019-15107-lab
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RIESGO
abrir ↗GitHub PoC
o-sec/CVE-2026-41452-poc
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
63RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-88854 — OrdaSoft Joomla Gallery unauth SQLi PoC (check / mass scan / EXTRACTVALUE read)
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
48RIESGO
abrir ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RIESGO
abrir ↗VulnCheck XDB
initial-access
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
48RIESGO
abrir ↗GitHub PoC
IDOR/BOLA in Events Manager <= 7.4.3 REST ticket update endpoint — CVE-2026-93661
Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
28RIESGO
abrir ↗GitHub PoC
CVE-2026-13447 - WordPress - inspireui - Critical 9.8 - Unauthenticated POST /wp-json/api/flutter_user/firebase_sms_v2 - Authentication Bypass
MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
48RIESGO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
PoC for CVE-2026-84434: unauthenticated arbitrary file upload in Gravity Forms ≤3.1.0.4 via hidden File Upload fields. Python check/exploit/mass scan.
Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
63RIESGO
abrir ↗GitHub PoC
Standalone authorized universal HTTP PoC for CVE-2026-75157
Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.