Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.554exploits catalogados
39.165CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientespopularesriesgo
16.153 exploits
GitHub PoC
Published Epson EH-TW5350 CVE · Hard-coded credentials · B-BEAM-BOB team
An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection
48RIESGO
abrir ↗GitHub PoC★ 5
XWP_RCE — CVE-2026-87902 Hacker Console
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RIESGO
abrir ↗GitHub PoC
Sanitized Cargo report and patch verification notes for CVE-2026-96876.
Anonymous reflected XSS in CargoExport invalid-alias errors
33RIESGO
abrir ↗GitHub PoC
Published Epson EH-TW5350 CVE · Firmware update verification bypass · B-BEAM-BOB team
Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector
48RIESGO
abrir ↗GitHub PoC
container escape POCs for CVE-2026-80521 and CVE-2026-52910
af_unix: Unlink scc_entry in unix_del_edge().
41RIESGO
abrir ↗GitHub PoC
A detection/hunting script for compromise related to CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RIESGO
abrir ↗GitHub PoC
CVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894
@xhmikosr/decompress: Path traversal via symlink chain
48RIESGO
abrir ↗GitHub PoC
CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware endpoint probe, lab-safe upload test. https://pocbit.org/pocs/cve-2026-8065
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions all
48RIESGO
abrir ↗GitHub PoC
CVE-2026-87902 — WordPress Core LFI → RCE
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RIESGO
abrir ↗GitHub PoC
Hands-on cybersecurity and CTF labs covering port reconnaissance, CMS stack discovery, VulnCMS, CVE-2026-58225, shell-to-root paths, Python, sudo, user switching, passwords, and post-exploitation.
SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service
28RIESGO
abrir ↗GitHub PoC★ 27
GitLab Unauthenticated Arbitrary File Read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
CVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
78RIESGO
abrir ↗GitHub PoC★ 1
Tooling related to CVE-2026-88771 and CVE-2026-88772
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RIESGO
abrir ↗GitHub PoC
craigsblackie/cve-2026-88771-netscaler
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RIESGO
abrir ↗GitHub PoC★ 26
ZeroDayEvil/CVE-2026-54121
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC★ 28
ZeroDayEvil/CVE-2026-41940-PoC
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RIESGO
abrir ↗GitHub PoC
Improper Input Validation (CWE-20) SSVC Scores Exploitation: Active Technical Impact: Total
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RIESGO
abrir ↗GitHub PoC
Hasyros/CVE-2026-101160-dos-wp-ultimate-review-rating
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating
41RIESGO
abrir ↗GitHub PoC★ 3
The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
48RIESGO
abrir ↗GitHub PoC
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-87902 — WordPress Core LFI → RCE by Hackfut
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RIESGO
abrir ↗GitHub PoC★ 22
ZeroDayEvil/CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗GitHub PoC
CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus.
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RIESGO
abrir ↗GitHub PoC★ 23
ZeroDayEvil/CVE-2026-62911
Microsoft Exchange Server Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC
Request a Quote for WooCommerce (Addify) <= 2.9.2 Unauthenticated arbitrary file upload via afrfq_submit_quote_via_popup
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
48RIESGO
abrir ↗GitHub PoC
Proof-of-Concept for CVE-2026-18110
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username
41RIESGO
abrir ↗GitHub PoC★ 18
Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778), CTX697174 (CVE-2026-88779) and CTX697191 (CVE-2026-107406, SAML RCE): build, CVE preconditions, SAML IdP/SP, Enhanced ISN, upgrade risks + IoC sweep by default with every public IoC (webshells, implants, 132 attacker IPs).
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RIESGO
abrir ↗GitHub PoC★ 26
ZeroDayEvil/CVE-2026-75604-PoC
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
63RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-82384 PoC: Apache Roller 6.1.5 unauthenticated XML-RPC ex:serializable Java deserialization (pre-auth RCE). Check, ysoserial exploit, mass bulk scanning, colored CLI. PoCbit — https://pocbit.org/pocs/cve-2026-82384
Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
48RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.