Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.127exploits catalogados

39.600CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.618Exploit-DB 24.485GitHub PoC 16.333VulnCheck XDB 9678Nuclei 4488Metasploit 3525✓ solo verificadosrecientes populares riesgo

16.335 exploits

GitHub PoC★ 3

One-liner Python LPE for CVE-2026-31431 (CopyFail2). No compilation, no dependencies beyond Python+OpenSSL. Just curl | python3 and get root on Linux 6.5+.

CVE-2026-31431HIGHbajo ataque07 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

GitHub PoC★ 4

Automatic script written in python for CVE-2009-3999

CVE-2009-3999—07 may 2026

Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to ex

60RIESGO

GitHub PoC

adilkurtulmus/linux-copy-fail-CVE-2026-31431

CVE-2026-31431HIGHbajo ataque07 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

GitHub PoC★ 1

CVE-2026-31431 Copy Fail

CVE-2026-31431HIGHbajo ataque07 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

GitHub PoC

CVE-2026-31431, AKA Copy Fail, can be mitigated in one-line with bpftrace

CVE-2026-31431HIGHbajo ataque07 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

GitHub PoC

abdelkabirouadoukou/CVE-2026-31431-Analysis-and-Fix

CVE-2026-31431HIGHbajo ataque07 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

GitHub PoC

borahll/CVE-2021-21220

CVE-2021-21220HIGHbajo ataque07 may 2026

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to po

100RIESGO

GitHub PoC

Caliburn9/CVE-2023-21716-Analysis-ICT287

CVE-2023-21716CRITICAL07 may 2026

Microsoft Word Remote Code Execution Vulnerability

70RIESGO

GitHub PoC

Proof-of-concept for CVE-2024-4040 (CrushFTP SSTI -> unauthenticated LFI) in a controlled CS443 lab environment - for educational/authorised use only.

CVE-2024-4040CRITICALbajo ataque06 may 2026

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

GitHub PoC★ 1

This is a proactive tool for security auditing. For your GitHub repository, you’ll want a description that highlights its safety (non-intrusive) and its specific utility for system administrators.

CVE-2026-23918HIGH06 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

GitHub PoC

CVE-2011-1249 (MS11-046) AFD privilege escalation — MinGW cross-compilation fix + custom command support

CVE-2011-1249—06 may 2026

The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vis

23RIESGO

GitHub PoC

seguridadentrerios/CVE-2026-23918

CVE-2026-23918HIGH06 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

GitHub PoC

CVE-2026-23918-Apache-HTTP-Server-DoubleFree-PoC

CVE-2026-23918HIGH06 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

GitHub PoC★ 1

Proof-of-concept exploit for CVE-2024-22120 that leverages time-based SQL injection and gopher-based SSRF to achieve remote code execution on vulnerable Zabbix servers for educational security research.

CVE-2024-22120CRITICAL06 may 2026

Time Based SQL Injection in Zabbix Server Audit Log

70RIESGO

GitHub PoC★ 1

mawussid/CVE-2026-41651-Python

CVE-2026-41651HIGH06 may 2026

PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

41RIESGO

GitHub PoC★ 8

PoC for CVE-2026-41940: WHM/cPanel authentication bypass chain (Python 2.7). For authorized security research and testing only.

CVE-2026-41940CRITICALbajo ataqueransomware06 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC

This repository contains an academic and technical analysis of CVE-2023-34362, a critical SQL injection vulnerability affecting the MOVEit Transfer application, a widely used enterprise Managed File Transfer (MFT) platform. The project was developed as part of the CYB625 – Ethical Hacking & Penetration Testing course at Pace University.

CVE-2023-34362CRITICALbajo ataqueransomware06 may 2026

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

100RIESGO

GitHub PoC

C implementation for researching Copy Fail (CVE-2026-31431)

CVE-2026-31431HIGHbajo ataque06 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

GitHub PoC★ 3

Exploit CVE-2026-31431 on Linux using a Rust implementation to achieve local privilege escalation via an arbitrary page cache write primitive.

CVE-2026-31431HIGHbajo ataque06 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

GitHub PoC★ 12

mitigation of cve-2026-31431 using ftrace

CVE-2026-31431HIGHbajo ataque06 may 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

GitHub PoC

ycseo-git/CVE-2020-11800

CVE-2020-11800CRITICAL06 may 2026

Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.

48RIESGO

GitHub PoC

roodhelios/CVE-2022-26134-OGNL-Injection

CVE-2022-26134CRITICALbajo ataqueransomware06 may 2026

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RIESGO

GitHub PoC

CVE-2026-41940

CVE-2026-41940CRITICALbajo ataqueransomware06 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC★ 1

Test authentication bypass vulnerabilities in cPanel and WHM using this proof of concept exploit tool written in Go.

CVE-2026-41940CRITICALbajo ataqueransomware06 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC★ 2

CVE-2026-40776 — Broken Access Control + IDOR in WordPress Eventin (wp-event-solution) <= 4.1.8

CVE-2026-40776HIGH06 may 2026

WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability

41RIESGO

GitHub PoC★ 23

Proof-of-Concept exploit for CVE-2026-23918 (Apache mod_http2 double-free). Features multi-mode DoS (Rapid-RST, Slow-Drip) and passive RCE/vulnerability detection for Apache 2.4.66.

CVE-2026-23918HIGH06 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

GitHub PoC

Analysis of network scan results, service vulnerabilities, OS fingerprinting, and critical Nessus findings including Ghostcat (CVE-2020-1938).

CVE-2020-1938CRITICALbajo ataque06 may 2026

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RIESGO

GitHub PoC★ 13

CVE-2026-41940 Auto Root Login

CVE-2026-41940CRITICALbajo ataqueransomware06 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC★ 1

Zimbra Path Traversal (CVE-2025-68645) - Unauthenticated file read vulnerability in Zimbra Collaboration Suite

CVE-2025-68645HIGHbajo ataque06 may 2026

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1

98RIESGO

GitHub PoC

MartinaStarone/CVE-2026-2441

CVE-2026-2441HIGHbajo ataque06 may 2026

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside

83RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.