Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

80.409exploits catalogados

37.196CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.478Referência 23.664GitHub PoC 15.347VulnCheck XDB 9003Nuclei 4415Metasploit 3502✓ solo verificadosrecientes populares riesgo

80.324 exploits

GitHub PoC

Qualitative TVRA for a multi-VLAN enterprise lab: Stored XSS on WebGoat (HIGH, 16), Stored XSS on Magento (ABSENT, MEDIUM, 8), and CVE-2017-0144 EternalBlue on Metasploitable 3 (CRITICAL, 25). Scored via Likelihood × Impact using CVSS v3.0 and ZAP/Nessus/Wireshark evidence.

CVE-2017-0144HIGHbajo ataqueransomware20 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

GitHub PoC★ 77

Apache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2023-46604，CVE-2024-32114，CVE-2026-34197，CVE-2026-40466， CVE-2026-42588)

CVE-2023-46604CRITICALbajo ataqueransomware20 abr 2026

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RIESGO

GitHub PoC★ 1

wa6n3r/CVE-2024-3400

CVE-2024-3400CRITICALbajo ataqueransomware20 abr 2026

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-33017CRITICALbajo ataque20 abr 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RIESGO

VulnCheck XDB

local

CVE-2021-3493HIGHbajo ataque20 abr 2026

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

98RIESGO

GitHub PoC

Professional vulnerability assessment of a multi-VLAN enterprise network (student21.local). Confirmed Stored XSS on WebGoat (HIGH, 16) via OWASP ZAP fuzzer, absent XSS on Magento via server sanitization, and CVE-2017-0144 EternalBlue on Metasploitable 3 (CRITICAL, 25) via Nessus + Wireshark PCAP validation.

CVE-2017-0144HIGHbajo ataqueransomware20 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

GitHub PoC★ 1

CVE-2025-31161

CVE-2025-31161CRITICALbajo ataqueransomware20 abr 2026

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RIESGO

GitHub PoC

Multi-VLAN virtual network across 10 VMs: GRE tunneling, nftables firewall, Active Directory, BIND9 DNS, Kea DHCP, Docker web services, SMB file sharing. Vulnerability assessment using OWASP ZAP (Stored XSS) and Nessus (CVE-2017-0144 EternalBlue). Validated with Wireshark.

CVE-2017-0144HIGHbajo ataqueransomware20 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

GitHub PoC

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

CVE-2026-3462MEDIUM20 abr 2026

Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification

33RIESGO

GitHub PoC★ 83

Apache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2023-46604，CVE-2024-32114，CVE-2026-34197，CVE-2026-40466， CVE-2026-42588)

CVE-2016-3088CRITICALbajo ataque20 abr 2026

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitr

100RIESGO

GitHub PoC

NetVanguard-cmd/CVE-2025-55315

CVE-2025-55315CRITICAL19 abr 2026

ASP.NET Security Feature Bypass Vulnerability

60RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2023-33538HIGHbajo ataque19 abr 2026

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabili

83RIESGO

GitHub PoC

CVE-2026-33017

CVE-2026-33017CRITICALbajo ataque19 abr 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RIESGO

GitHub PoC★ 3

Cyb3rCr0wCC/cve-2017-11176

CVE-2017-11176—19 abr 2026

The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retr

23RIESGO

VulnCheck XDB

initial-access

CVE-2026-35616CRITICALbajo ataque19 abr 2026

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta

100RIESGO

GitHub PoC

Exploiting Bluekeep (CVE-2019-0708) on windows 7 using metasploit (Esucational lab)

CVE-2019-0708CRITICALbajo ataqueransomware19 abr 2026

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau

100RIESGO

GitHub PoC

rediscovered tplink nday xp (CVE-2023-33538)

CVE-2023-33538HIGHbajo ataque19 abr 2026

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerabili

83RIESGO

GitHub PoC

NetVanguard-cmd/CVE-2025-61882

CVE-2025-61882CRITICALbajo ataqueransomware19 abr 2026

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integratio

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-39808CRITICALbajo ataque18 abr 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-27542CRITICAL18 abr 2026

WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability

63RIESGO

VulnCheck XDB

client-side

CVE-2026-25253HIGH18 abr 2026

OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically mak

46RIESGO

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALbajo ataque18 abr 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

GitHub PoC★ 1

CVE-2026-22241

CVE-2026-22241HIGH18 abr 2026

Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

41RIESGO

GitHub PoC

Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback

CVE-2025-6389CRITICAL18 abr 2026

Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback

85RIESGO

GitHub PoC

Security research & exploitation analysis of CVE-2025-55182 (React) — CVSS + OWASP Top 10 mapping

CVE-2025-55182CRITICALbajo ataqueransomware18 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-1492CRITICAL18 abr 2026

User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration

68RIESGO

VulnCheck XDB

initial-access

CVE-2025-15030CRITICAL18 abr 2026

User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset

48RIESGO

VulnCheck XDB

initial-access

CVE-2025-13342CRITICAL18 abr 2026

Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

63RIESGO

GitHub PoC

jithinodattu/CVE-2007-4559-lab

CVE-2007-4559CRITICAL18 abr 2026

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows

53RIESGO

GitHub PoC

Implements the mitigation for CVE-2025-54505 as described by AMD-SB-7053

CVE-2025-54505LOW18 abr 2026

A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floa

28RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.