Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

80.409exploits catalogados

37.196CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.478Referência 23.664GitHub PoC 15.347VulnCheck XDB 9003Nuclei 4415Metasploit 3502✓ solo verificadosrecientes populares riesgo

80.324 exploits

VulnCheck XDB

initial-access

CVE-2026-3844CRITICAL24 abr 2026

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

68RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2025-55177 + CVE-2025-43300: reverse-engineering the WhatsApp-ImageIO zero-click iOS chain, with interactive labs.

CVE-2025-55177MEDIUMbajo ataque24 abr 2026

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Bu

63RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-21962CRITICALbajo ataque24 abr 2026

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (compo

90RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-25895CRITICAL24 abr 2026

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

68RIESGO

abrir ↗

VulnCheck XDB

denial-of-service

CVE-2023-44487HIGHbajo ataque24 abr 2026

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many

93RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2014-6271CRITICALbajo ataque24 abr 2026

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RIESGO

abrir ↗

GitHub PoC

Unauthenticated_RCE.CVE-2025-47812

CVE-2025-47812CRITICALbajo ataque24 abr 2026

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o

100RIESGO

abrir ↗

GitHub PoC

Bug Bounty: CVE-2023-50839 IDOR identified in a third-party support component via 'gau' and 'Nuclei'. Despite perimeter redirects, the outdated software remained exposed. Confirmed through manual header analysis. Severity: 5.3 (Medium). Focused on Defense in Depth failures and PII protection. Status: Reported on Intigriti.

CVE-2023-50839CRITICAL24 abr 2026

WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection

63RIESGO

abrir ↗

GitHub PoC

End-to-end cybersecurity project demonstrating detection and mitigation of CVE-2024-38063 using IDS, host-based monitoring, and virtual lab attack simulation.

CVE-2024-38063CRITICAL24 abr 2026

Windows TCP/IP Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC

Poc for React2Shell CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware24 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

End-to-end SOC investigation: CVE-2011-2523 kill chain, multi-source log correlation, incident report — MITRE ATT&CK T1190

CVE-2011-2523—24 abr 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

abrir ↗

GitHub PoC

POC exploit for CVE-2026-25895 FUXA Unauthenticated Path Traversal -> Arbitrary File Write -> RCE

CVE-2026-25895CRITICAL24 abr 2026

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

68RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2025-68645

CVE-2025-68645HIGHbajo ataque24 abr 2026

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1

98RIESGO

abrir ↗

GitHub PoC★ 1

its simple Shellshock exploit

CVE-2014-6271CRITICALbajo ataque24 abr 2026

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RIESGO

abrir ↗

GitHub PoC

Cybersecurity lab demonstrating exploitation of CVE-2017-0144 (EternalBlue) using Metasploit against a vulnerable Windows 7 VM, achieving SYSTEM-level access via Meterpreter. Includes full attack chain, post exploitation, and mitigation via MS17-010 patching, tested in an isolated ethical lab environment.

CVE-2017-0144HIGHbajo ataqueransomware23 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-39813CRITICAL23 abr 2026

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.

53RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2017-0144HIGHbajo ataqueransomware23 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

GitHub PoC

Find jenkins environment and checks for CVE-2024-23897

CVE-2024-23897CRITICALbajo ataqueransomware23 abr 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RIESGO

abrir ↗

GitHub PoC

CVE-2024-3094

CVE-2024-3094CRITICAL23 abr 2026

Xz: malicious code in distributed source

70RIESGO

abrir ↗

GitHub PoC★ 1

Recreation and analysis of a curious logic error in Apache 2.4.49 that escalated to remote code execution

CVE-2021-41773HIGHbajo ataqueransomware23 abr 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC

HackTheBox TwoMillion machine writeup — API abuse, command injection & CVE-2023-0386

CVE-2023-0386HIGHbajo ataque23 abr 2026

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa

86RIESGO

abrir ↗

GitHub PoC★ 2

SQL Injection vulnerability in NASA EOSDIS MODAPS due to improper input validation in the `category` parameter. This flaw allows attackers to manipulate backend SQL queries, potentially leading to unauthorized data access and database compromise.

CVE-2024-46636CRITICAL22 abr 2026

NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection v

48RIESGO

abrir ↗

VulnCheck XDB

client-side

CVE-2023-4863HIGHbajo ataque22 abr 2026

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to

93RIESGO

abrir ↗

GitHub PoC

CVEs-Labs/CVE-2026-21876

CVE-2026-21876CRITICAL22 abr 2026

OWASP CRS has multipart bypass using multiple content-type parts

53RIESGO

abrir ↗

GitHub PoC

Sanitized advisory for CVE-2025-51846 affecting CryptPad WebSocket handling.

CVE-2025-51846HIGH22 abr 2026

CryptPad unbounded WebSocket frame flood

41RIESGO

abrir ↗

GitHub PoC

Security toolkit for CVE-2025-55182 (React2Shell) — scan, detect, correlate, and test React Server Components RCE vulnerability

CVE-2025-55182CRITICALbajo ataqueransomware22 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

Metasploit600

Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload

CVE-2026-34415CRITICAL22 abr 2026

Xerte Online Toolkits File Upload RCE via elfinder Connector

63RIESGO

abrir ↗

Metasploit600

Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload

CVE-2026-34414HIGH22 abr 2026

Xerte Online Toolkits Path Traversal via connector.php

56RIESGO

abrir ↗

Metasploit600

Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload

CVE-2026-34413HIGH22 abr 2026

Xerte Online Toolkits Missing Authentication via connector.php

56RIESGO

abrir ↗

Metasploit600

Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload

CVE-2026-41459MEDIUM22 abr 2026

Xerte Online Toolkits Path Disclosure via /setup

48RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.