Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

80.409exploits catalogados

37.196CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.478Referência 23.664GitHub PoC 15.347VulnCheck XDB 9003Nuclei 4415Metasploit 3502✓ solo verificadosrecientes populares riesgo

80.324 exploits

GitHub PoC★ 4

GOGS RCE cve-2025-8110 python script that automates the whole attack chain of creating a repository with a symlink file pointing to .git/config and then triggering rce via a poisoned sshCommand on the config file.

CVE-2025-8110HIGHbajo ataque11 abr 2026

File overwrite in file update API in Gogs

100RIESGO

GitHub PoC

CVE-2025-55182 (React2Shell) PoC: Unauthenticated RCE affecting React 19.x and Next.js < 15.1.4. Exploits vulnerabilities in the RSC Flight protocol.

CVE-2025-55182CRITICALbajo ataqueransomware10 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

Exploit-DB

NetBT e-Fatura - Privilege Escalation

CVE-2025-14018HIGHlocalmultiple10 abr 2026

Unquoted Service Path in NetBT Consultancy's e-Fatura

41RIESGO

GitHub PoC

PoC of CVE-2021-44228

CVE-2021-44228CRITICALbajo ataqueransomware10 abr 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC★ 6

High-interaction honeypot mimicking a vulnerable Laravel/Livewire app. Captures RCE exploits and webshells targeting CVE-2024-47823, CVE-2025-54068, and CVE-2025-14894, then analyzes them in sandboxed Docker containers to extract IOCs.

CVE-2025-54068CRITICALbajo ataque10 abr 2026

Livewire vulnerable to remote command execution during property update hydration

100RIESGO

GitHub PoC

CVE-2025-55182 Auto Scanner - Improved Version For authorized CTF/testing purposes only

CVE-2025-55182CRITICALbajo ataqueransomware10 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

Demo to remediate CVE-2023-20198 using forward networks and tines

CVE-2023-20198CRITICALbajo ataque10 abr 2026

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS

100RIESGO

GitHub PoC

Improper Access Control in Mysterium Node before v1.36.0

CVE-2026-31309CRITICAL10 abr 2026

Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows a

48RIESGO

GitHub PoC

Estudio técnico de la vulnerabilidad CVE-2025-5548

CVE-2025-5548MEDIUM10 abr 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RIESGO

GitHub PoC

CVE-2021-22911 Rocket.Chat NoSQL Injection RCE Exploit - Educational Purpose

CVE-2021-22911—10 abr 2026

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti

60RIESGO

GitHub PoC★ 2

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file.

CVE-2023-6553CRITICAL10 abr 2026

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

85RIESGO

VulnCheck XDB

initial-access

CVE-2021-22911—10 abr 2026

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti

60RIESGO

GitHub PoC★ 4

MCPJam Inspector is a local-first development platform for MCP servers. In versions 1.4.2 (and earlier), a RCE flaw lets attackers send crafted HTTP request that installs an MCP server and runs code remotely, because the service listens on 0.0.0.0 (instead of 127.0.0.1) by default.

CVE-2026-23744CRITICAL10 abr 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

GitHub PoC

Educational Proof-of-Concept for the CVE-2022-30190 (Follina) vulnerability.

CVE-2022-30190HIGHbajo ataqueransomware10 abr 2026

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2026-34197HIGHbajo ataque10 abr 2026

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALbajo ataqueransomware10 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC★ 1

Hunt-Benito/samsung-exynos-sms-stack-overflow-cve-2025-54328-critical-zero-click-baseband-rce

CVE-2025-54328CRITICAL10 abr 2026

An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 21

48RIESGO

VulnCheck XDB

initial-access

CVE-2021-44228CRITICALbajo ataqueransomware10 abr 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL10 abr 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

Metasploit600

Paperclip AI RCE using a chain of six API calls (CVE-2026-41679).

CVE-2026-41679CRITICAL10 abr 2026

Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

48RIESGO

GitHub PoC

Browser-based MCP CTF — OAuth token confusion and session isolation failure (CVE-2025-49596 pattern). DevTools only.

CVE-2025-49596CRITICAL10 abr 2026

MCP Inspector proxy server lacks authentication between the Inspector client and proxy

75RIESGO

GitHub PoC

powerfull rust cve-2025-55182-scanner used for ctf & ethical purpose only

CVE-2025-55182CRITICALbajo ataqueransomware10 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

Exploit-DB

React Server 19.2.0 - Remote Code Execution

CVE-2025-55182CRITICALbajo ataqueransomwarewebappsmultiple09 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

Majdae/CVE-2025-47812-Research

CVE-2025-47812CRITICALbajo ataque09 abr 2026

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o

100RIESGO

VulnCheck XDB

info-leak

CVE-2026-21858CRITICAL09 abr 2026

n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

85RIESGO

GitHub PoC★ 1

Unauthenticated RCE vulnerability in Fuel CMS 1.4.1.

CVE-2018-16763—09 abr 2026

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RIESGO

GitHub PoC

CVE-2025-32433

CVE-2025-32433CRITICALbajo ataque09 abr 2026

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RIESGO

GitHub PoC

CVE-2024-3094 - XZ Utils Backdoor

CVE-2024-3094CRITICAL09 abr 2026

Xz: malicious code in distributed source

70RIESGO

GitHub PoC

Performed a live cybersecurity assessment on a university Linux server. During analysis, active attack activity was identified, including brute-force authentication attempts and exploitation attempts targeting Log4Shell (CVE-2021-44228).

CVE-2021-44228CRITICALbajo ataqueransomware09 abr 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC

Xibo CMS CVE-2023-33177 Vulnerability Tester

CVE-2023-33177HIGH09 abr 2026

Xibo CMS vulnerable to Remote Code Execution through Zip Slip

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.