Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.056 exploits
GitHub PoC
In the miniOrange 2FA WordPress plugin (versions before 6.3.1 and 19.3), the two-factor authentication (2FA) attempt limit is flawed.
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
41RIESGO
abrir ↗GitHub PoC
University Project of developing a template for safely testing for the CVE 2025-24813 on a server. It is intentionally made to not leave any lasting artifacts on the server and does not disrupt its activities.
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-85706 — GitLab Path Traversal IOC Scanner & Detection Toolkit. Detect and hunt for exploitation of the critical unauthenticated GitLab CE/EE path traversal vulnerability with IOC scanning, Sigma, Suricata/Snort, and SIEM detection rules.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
Defensive IOC and detection toolkit for CVE-2026-86218, a critical pre-auth RCE in N-able N-central. Includes IOCs, log scanner, Sigma, Splunk, Elastic/KQL detections, and incident response guidance.
pre-authentication remote code execution
98RIESGO
abrir ↗VulnCheck XDB
initial-access
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
100RIESGO
abrir ↗GitHub PoC★ 6
SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.
Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social en
33RIESGO
abrir ↗GitHub PoC
Sanitized offline fixture verifier for CVE-2026-81861 in SCADAPack Secure Lock
CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information
33RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-18351 — Drag and Drop File Upload for Elementor Forms <= 1.6.0 Unauthenticated Arbitrary File Upload -> RCE
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
48RIESGO
abrir ↗VulnCheck XDB
initial-access
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh
60RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-51990 - Draft or TODO
An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary
48RIESGO
abrir ↗GitHub PoC
OpenPanel Unauthenticated Server-Side Request Forgery (SSRF)
OpenPanel before 2.3.0 SSRF via favicon and og endpoints
41RIESGO
abrir ↗Exploit-DB
CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22_ 10.0 < 10.10_ 11.0 < 11.3 - RCE
ILIAS PHP Object Injection via Shibboleth Logout
48RIESGO
abrir ↗GitHub PoC
Writeup: Hackcar - DockerLabs (Node.js Inspector RCE + CVE-2025-55182 React2Shell)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory.
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbi
33RIESGO
abrir ↗GitHub PoC
Drag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.🔥
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
48RIESGO
abrir ↗GitHub PoC
Easy Media Replace <= 0.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title
33RIESGO
abrir ↗GitHub PoC★ 9
CVE-2026-85706 Unauthenticated File Read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
SecDim Challenge Builder repro inspired by CVE-2026-88861: AAL1 MFA bypass at privileged credential boundary
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
41RIESGO
abrir ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗VulnCheck XDB
initial-access
FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE
63RIESGO
abrir ↗GitHub PoC
PoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
Wordpress Plugin ELEX WooCommerce Request a Quote unauthenticated SQL injection POC
ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id
41RIESGO
abrir ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RIESGO
abrir ↗VulnCheck XDB
local
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RIESGO
abrir ↗GitHub PoC★ 1
End-to-end recon and exploitation of a known backdoor (CVE-2010-2075) on Metasploitable2 using Nmap and Metasploit.
UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally
60RIESGO
abrir ↗GitHub PoC
Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery
WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability
41RIESGO
abrir ↗GitHub PoC
Write-up and proof of concept for CVE-2026-20516: MediaTek Android TV MiracastService confused deputy vulnerability.
In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denia
33RIESGO
abrir ↗VulnCheck XDB
info-leak
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RIESGO
abrir ↗GitHub PoC
WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.