Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.056 exploits
VulnCheck XDB
initial-access
Apache Camel: Camel Message Header Injection via Improper Filtering
55RIESGO
abrir ↗VulnCheck XDB
client-side
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code in
71RIESGO
abrir ↗GitHub PoC
CVE-2016-3223 - Draft or TODO
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an
28RIESGO
abrir ↗GitHub PoC
ivanesk315/CVE-2026-13181-Telerik
RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
41RIESGO
abrir ↗GitHub PoC
The MariaDB 13.1.0 RCE LAB is a testing environment designed to validate an exploit chain that combines an OOB Read vulnerability in the share->field pointer array with multiple additional vulnerabilities, ultimately achieving arbitrary code execution with mysql privileges.
MariaDB: insufficient validation of binary frm data when opening a table
41RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗GitHub PoC
Walkthrough, threat analysis, and remediation guide for CVE-2017-0144 (EternalBlue).
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗GitHub PoC
ivanesk315/CVE-2026-60137-and-CVE-2026-63030
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as
83RIESGO
abrir ↗VulnCheck XDB
client-side
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside
71RIESGO
abrir ↗GitHub PoC
PrinceAikinsBaidoo/CVE-2022-24637
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh
60RIESGO
abrir ↗GitHub PoC
ivanesk315/CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RIESGO
abrir ↗GitHub PoC★ 1
Conducted a complete security assessment of an unpatched Windows 7 target ("Blue") to demonstrate the impact of legacy service vulnerabilities in an enterprise environment
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗GitHub PoC
vudangducminh/CVE-2022-0847
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RIESGO
abrir ↗GitHub PoC
ivanesk315/CVE-2026-66066
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
75RIESGO
abrir ↗GitHub PoC
Jasper2018/CVE-2018-20062
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP
100RIESGO
abrir ↗GitHub PoC
ethicbrudhack/CVE-2008-0166-BTC-satoshi-mining-wallets
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge
45RIESGO
abrir ↗Metasploit300
GitLab Unauthenticated Arbitrary File Read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
Saku0512/CVE-2026-72815-poc
go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header
33RIESGO
abrir ↗GitHub PoC★ 5
SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code in
71RIESGO
abrir ↗GitHub PoC
ivanesk315/CVE-2026-28496
FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE
63RIESGO
abrir ↗GitHub PoC★ 1
Mikrotik CVE-2026-86060 Score 9.2 Critical
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RIESGO
abrir ↗GitHub PoC
CVE-2026-79387-PbootCMS-SQL-Injection
SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary us
33RIESGO
abrir ↗GitHub PoC
CVE-2026-67401 - Draft or TODO
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RIESGO
abrir ↗GitHub PoC★ 1
AD CS 证书身份伪造漏洞，属于ESC（Exploit Certification）系列 的新成员
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC★ 3
poc in python for CVE-2026-67401
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RIESGO
abrir ↗VulnCheck XDB
initial-access
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
78RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.