Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.056 exploits
GitHub PoC★ 1
CVE-2026-87796 - Multi Uploader for Gravity Forms <= 1.1.9; Unauthorized RCE (CRITICAL 9.8)
Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload
48RIESGO
abrir ↗GitHub PoC
isaca0315/CVE-2026-44840-poc
Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
41RIESGO
abrir ↗GitHub PoC★ 1
exploit para reverse shell en MCPJamInspector v1.4.2< por endpoint mal configurado
REC in MCPJam inspector due to HTTP Endpoint exposes
75RIESGO
abrir ↗GitHub PoC
CVE-2026-48908 SP Page Builder (Joomla) unauth RCE suite — authorized testing only
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
100RIESGO
abrir ↗GitHub PoC
Educational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking production Metabase.
Metabase: Unsafe Deserialization of H2 Query Results
48RIESGO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
100RIESGO
abrir ↗GitHub PoC★ 1
Forensic Analysis and Local Replication of the OpenAI-Artifactory Privilege Escalation Incident (CVE-2026-65616)
Potential privilege escalation to JFrog administrator privileges
41RIESGO
abrir ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
A Python-based security tool for checking sudo versions for potential exposure to CVE-2021-3156 (Baron Samedit). Designed for authorized security testing and learning.
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RIESGO
abrir ↗GitHub PoC★ 2
Unbounded memory allocation in NanaZip's UFS handler via an attacker-controlled `fs_bsize` field.
NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
28RIESGO
abrir ↗GitHub PoC
CVE-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
CVE-2026-12793 - JetFormBuilder Unauthorized RCE (CRITICAL 9.8)
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
48RIESGO
abrir ↗GitHub PoC
SangSenimanWartefak/CVE-2026-80467
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-87930 Joomla Multi-CVE RCE suite — authorized testing only
MaxSite CMS through 109.6 PHP Object Injection via ci_session
48RIESGO
abrir ↗GitHub PoC
CVE-2026-19975 - Draft or TODO
Azuriom CMS Money Transfer ProfileController.php transferMoney toctou
28RIESGO
abrir ↗GitHub PoC
Isolated educational FreePBX-compatible cyber range for CVE-2025-57819 (CWE-89/CWE-288). Docker lab — not official Sangoma FreePBX.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability
48RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
100RIESGO
abrir ↗GitHub PoC★ 3
Unbounded memory allocation in NanaZip's UFS handler via an attacker-controlled `fs_bsize` field.
NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
28RIESGO
abrir ↗GitHub PoC
Issabel pbxapi hard coded JWT RCE POC
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
63RIESGO
abrir ↗GitHub PoC
UVdesk unauth wizard super-admin POC
UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
28RIESGO
abrir ↗GitHub PoC★ 1
My first CVE
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoi
33RIESGO
abrir ↗VulnCheck XDB
info-leak
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RIESGO
abrir ↗GitHub PoC
avergnaud/flight-sql-jdbc-driver-cve-2026-54512
jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
41RIESGO
abrir ↗GitHub PoC
Unofficial Apache Doris Spark connector 26.1.0 security fork for Java / Spark 3.5.1 / Scala 2.12; patched shaded Jackson for CVE-2026-54512.
jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
41RIESGO
abrir ↗GitHub PoC★ 1
Issabel pbxapi hard coded JWT RCE POC
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
63RIESGO
abrir ↗VulnCheck XDB
initial-access
Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate
63RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.