Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

80.409exploits catalogados

37.196CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.478Referência 23.664GitHub PoC 15.347VulnCheck XDB 9003Nuclei 4415Metasploit 3502✓ solo verificadosrecientes populares riesgo

80.324 exploits

GitHub PoC★ 1

HTB Snapped — Hard Linux machine writeup. CVE-2026-27944 (Nginx UI unauthenticated backup disclosure) chained with CVE-2026-3888 (snapd race condition LPE) to achieve full system compromise.

CVE-2026-27944CRITICAL07 may 2026

Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

68RIESGO

GitHub PoC

CVE-2026-31431 (Copy Fail) novel exploit: live code corruption via page cache. Overwrites libc exit() code through MAP_PRIVATE page sharing — affects ALL running processes.

CVE-2026-31431HIGHbajo ataque07 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

GitHub PoC

CVE-2026-31431, AKA Copy Fail, can be mitigated in one-line with bpftrace

CVE-2026-31431HIGHbajo ataque07 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

VulnCheck XDB

info-leak

CVE-2026-7482HIGH07 may 2026

Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers

41RIESGO

Exploit-DB

ThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)

CVE-2025-34282MEDIUMwebappsmultiple07 may 2026

ThingsBoard < v4.2.1 SVG Image SSRF

33RIESGO

GitHub PoC★ 3

One-liner Python LPE for CVE-2026-31431 (CopyFail2). No compilation, no dependencies beyond Python+OpenSSL. Just curl | python3 and get root on Linux 6.5+.

CVE-2026-31431HIGHbajo ataque07 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

GitHub PoC

CVE-2026-3844

CVE-2026-3844CRITICAL07 may 2026

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

68RIESGO

GitHub PoC★ 1

CVE-2026-23918 Apache mod_http2 Double-Free Detector

CVE-2026-23918HIGH07 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

GitHub PoC

Analysis of network scan results, service vulnerabilities, OS fingerprinting, and critical Nessus findings including Ghostcat (CVE-2020-1938).

CVE-2020-1938CRITICALbajo ataque06 may 2026

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RIESGO

GitHub PoC

seguridadentrerios/CVE-2026-23918

CVE-2026-23918HIGH06 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

VulnCheck XDB

info-leak

CVE-2024-4040CRITICALbajo ataque06 may 2026

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

VulnCheck XDB

local

CVE-2026-31431HIGHbajo ataque06 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

VulnCheck XDB

local

CVE-2026-31431HIGHbajo ataque06 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

VulnCheck XDB

local

CVE-2026-31431HIGHbajo ataque06 may 2026

crypto: algif_aead - Revert to operating out-of-place

100RIESGO

GitHub PoC

This repository contains an academic and technical analysis of CVE-2023-34362, a critical SQL injection vulnerability affecting the MOVEit Transfer application, a widely used enterprise Managed File Transfer (MFT) platform. The project was developed as part of the CYB625 – Ethical Hacking & Penetration Testing course at Pace University.

CVE-2023-34362CRITICALbajo ataqueransomware06 may 2026

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

100RIESGO

GitHub PoC

CVE-2026-23918-Apache-HTTP-Server-DoubleFree-PoC

CVE-2026-23918HIGH06 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

GitHub PoC

CVE-2026-41940

CVE-2026-41940CRITICALbajo ataqueransomware06 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC★ 12

CVE-2026-41940 Auto Root Login

CVE-2026-41940CRITICALbajo ataqueransomware06 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC★ 6

PoC for CVE-2026-41940: WHM/cPanel authentication bypass chain (Python 2.7). For authorized security research and testing only.

CVE-2026-41940CRITICALbajo ataqueransomware06 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC★ 1

Test authentication bypass vulnerabilities in cPanel and WHM using this proof of concept exploit tool written in Go.

CVE-2026-41940CRITICALbajo ataqueransomware06 may 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC★ 2

CVE-2026-40776 — Broken Access Control + IDOR in WordPress Eventin (wp-event-solution) <= 4.1.8

CVE-2026-40776HIGH06 may 2026

WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability

41RIESGO

GitHub PoC

MartinaStarone/CVE-2026-2441

CVE-2026-2441HIGHbajo ataque06 may 2026

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside

76RIESGO

GitHub PoC★ 1

Zimbra Path Traversal (CVE-2025-68645) - Unauthenticated file read vulnerability in Zimbra Collaboration Suite

CVE-2025-68645HIGHbajo ataque06 may 2026

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1

98RIESGO

GitHub PoC

Proof-of-concept for CVE-2024-4040 (CrushFTP SSTI -> unauthenticated LFI) in a controlled CS443 lab environment - for educational/authorised use only.

CVE-2024-4040CRITICALbajo ataque06 may 2026

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RIESGO

GitHub PoC

CVE-2011-1249 (MS11-046) AFD privilege escalation — MinGW cross-compilation fix + custom command support

CVE-2011-1249—06 may 2026

The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vis

23RIESGO

GitHub PoC★ 23

Proof-of-Concept exploit for CVE-2026-23918 (Apache mod_http2 double-free). Features multi-mode DoS (Rapid-RST, Slow-Drip) and passive RCE/vulnerability detection for Apache 2.4.66.

CVE-2026-23918HIGH06 may 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

GitHub PoC

ycseo-git/CVE-2020-11800

CVE-2020-11800CRITICAL06 may 2026

Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.

48RIESGO

GitHub PoC★ 1

This repository contains a Python replication script for CVE-2025-4632, an Unauthenticated Remote Code Execution (RCE) vulnerability in Samsung MagicINFO 9 Server (versions prior to 21.1052).

CVE-2025-4632CRITICALbajo ataque06 may 2026

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2

98RIESGO

GitHub PoC★ 1

Proof-of-concept exploit for CVE-2024-22120 that leverages time-based SQL injection and gopher-based SSRF to achieve remote code execution on vulnerable Zabbix servers for educational security research.

CVE-2024-22120CRITICAL06 may 2026

Time Based SQL Injection in Zabbix Server Audit Log

70RIESGO

GitHub PoC

roodhelios/CVE-2022-26134-OGNL-Injection

CVE-2022-26134CRITICALbajo ataqueransomware06 may 2026

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.