Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC

This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).

CVE-2017-17215—07 sep 2026

Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could se

45RIESGO

GitHub PoC

Log4Shell (CVE-2021-44228) exploitation from a Kali VM against a vulnerable containerized app, with Splunk-based detection engineering and validated remediation. Covers the full attack lifecycle: exploitation, JNDI and host-level auditd detection, and before/after remediation proof.

CVE-2021-44228CRITICALbajo ataqueransomware07 sep 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC

Linux Kernel Exploits -> CVE-2005-0736 + CVE-2005-1263

CVE-2005-0736—07 sep 2026

Integer overflow in sys_epoll_wait in eventpoll.c for Linux kernel 2.6 to 2.6.11 allows local users to overwrite kernel

23RIESGO

GitHub PoC

Eliot-code/CVE-2026-85046

CVE-2026-85046HIGHbajo ataque07 sep 2026

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

71RIESGO

GitHub PoC

This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).

CVE-2018-14847CRITICALbajo ataque07 sep 2026

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated

100RIESGO

GitHub PoC

BlueGate Exploit validator - RD Gateway validator for CVE-2020-0609 and CVE-2020-0610 (BlueGate) using OpenSSL DTLS over UDP/3391.

CVE-2020-0609—07 sep 2026

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

45RIESGO

GitHub PoC

Buffer overflow in FreeFloat FTP Server 1.0

CVE-2025-5548MEDIUM07 sep 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RIESGO

GitHub PoC

Advisory: Cute Editor 6.4 reflected XSS via 'Theme' parameter in colorpicker_more.aspx

CVE-2021-3030MEDIUM06 sep 2026

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme G

33RIESGO

GitHub PoC

A mock app for the GitLab CVE-2023-7028, which allow multile email adresses when ordering a password reset.

CVE-2023-7028CRITICALbajo ataque06 sep 2026

Weak Password Recovery Mechanism for Forgotten Password in GitLab

100RIESGO

GitHub PoC★ 105

CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC

CVE-2026-67276CRITICAL06 sep 2026

SSH user impersonation possible in Mikrotik RouterOS

48RIESGO

GitHub PoC

CVE-2021-44228 Log4Shell reproduced end to end: exploitation through remediation

CVE-2021-44228CRITICALbajo ataqueransomware06 sep 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC

LangGrinch - CVE-2025-68664 demo

CVE-2025-68664CRITICAL06 sep 2026

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

60RIESGO

GitHub PoC

katranSefa/CVE-2026-19949

CVE-2026-19949HIGH06 sep 2026

All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

41RIESGO

VulnCheck XDB

initial-access

CVE-2026-67276CRITICAL06 sep 2026

SSH user impersonation possible in Mikrotik RouterOS

48RIESGO

GitHub PoC

este laboratorio puede estar bien o mal preguntale a la IA estoy probando pero debe funcionar hahahah

CVE-2026-64849CRITICALbajo ataque06 sep 2026

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

98RIESGO

GitHub PoC

0xCyp1337/CVE-2026-44402

CVE-2026-44402CRITICAL06 sep 2026

Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi

48RIESGO

VulnCheck XDB

initial-access

CVE-2026-6279CRITICAL06 sep 2026

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

63RIESGO

GitHub PoC★ 121

**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.

CVE-2026-18963CRITICAL06 sep 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

VulnCheck XDB

initial-access

CVE-2025-31324CRITICALbajo ataqueransomware06 sep 2026

Missing Authorization check in SAP NetWeaver (Visual Composer development server)

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-67276CRITICAL06 sep 2026

SSH user impersonation possible in Mikrotik RouterOS

48RIESGO

VulnCheck XDB

info-leak

CVE-2026-64849CRITICALbajo ataque06 sep 2026

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

98RIESGO

VulnCheck XDB

initial-access

CVE-2026-18963CRITICAL06 sep 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

VulnCheck XDB

initial-access

CVE-2021-44228CRITICALbajo ataqueransomware06 sep 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-82222CRITICAL06 sep 2026

WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

63RIESGO

GitHub PoC

0xCyp1337/CVE-2026-82222-MassExploit

CVE-2026-82222CRITICAL06 sep 2026

WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

63RIESGO

VulnCheck XDB

info-leak

CVE-2025-24799HIGH06 sep 2026

GLPI allows unauthenticated SQL injection through the inventory endpoint

78RIESGO

VulnCheck XDB

initial-access

CVE-2025-57819CRITICALbajo ataque06 sep 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RIESGO

GitHub PoC★ 1

CVE-2026-67276 - Draft or TODO

CVE-2026-67276CRITICAL06 sep 2026

SSH user impersonation possible in Mikrotik RouterOS

48RIESGO

GitHub PoC

CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE (PoC)

CVE-2025-57819CRITICALbajo ataque06 sep 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RIESGO

GitHub PoC★ 2

Keycloak Blind SSRF POC

CVE-2020-10770—05 sep 2026

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using

50RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.