Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.056 exploits
VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
100RIESGO
abrir ↗Exploit-DB
Joomla 2.9.99.4 - Unauthenticated Remote Code Execution
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗Exploit-DB
OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
63RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-23744 is an unauthenticated command injection in MCPJam Inspector ≤1.4.2 via /api/mcp/connect. This POC exploits it by sending a crafted JSON payload to execute arbitrary commands, granting a reverse shell with PTY.
REC in MCPJam inspector due to HTTP Endpoint exposes
75RIESGO
abrir ↗GitHub PoC★ 1
IamDremig/CVE-2026-65591
n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
41RIESGO
abrir ↗GitHub PoC
Proof of Concept (PoC) WebSocket client for CVE-2026-39987 (Marimo Pre-Auth RCE), intended for authorized security testing.
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-64747 AGXG14P count-bitmask OOB trigger probe (A15/iOS 26.5.2)
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iO
41RIESGO
abrir ↗GitHub PoC★ 1
Tracking SCTPhantom (CVE-2026-64564), the Linux kernel SCTP ASCONF transport use-after-free
sctp: don't free the ASCONF's own transport in DEL-IP processing
48RIESGO
abrir ↗GitHub PoC
CVE-2026-19264 - Critical unauthenticated path traversal to full instance takeover in Postiz (< 2.22.1). Technical writeup: decode-order bypass, JWT_SECRET escalation, and analysis of the upstream fix.
Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
48RIESGO
abrir ↗GitHub PoC
Authorized Kali–Metasploitable2 lab using Python and Nmap NSE to validate CVE-2011-2523 in vsFTPd 2.3.4.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗GitHub PoC
The poc of CVE-2026-23744
REC in MCPJam inspector due to HTTP Endpoint exposes
75RIESGO
abrir ↗GitHub PoC
CVE-2026-43499 GhostLock APK 骨架 — 从零开始，仅空项目编译验证
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
CVE-2026-20685 - Draft or TODO
An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addres
33RIESGO
abrir ↗VulnCheck XDB
initial-access
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RIESGO
abrir ↗VulnCheck XDB
initial-access
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RIESGO
abrir ↗Exploit-DB
Microsoft Edge 150.0.4078.48 - RCE
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
48RIESGO
abrir ↗GitHub PoC★ 25
CVE-2026-53361 AF_UNIX GC vs MSG_PEEK use-after-free container escape
af_unix: Set gc_in_progress to true in unix_gc().
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-64824 — Home Assistant backup-restore symlink path traversal → root RCE. First working PoC, verified on real HA 2026.5.4 (sitecustomize.py overwrite). GHSA-cwh8-w64c-4j5h
Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore
48RIESGO
abrir ↗GitHub PoC
Closed-loop vulnerability remediation: detect -> reproduce exploit -> generate patch -> verify with a proof harness. Worked example: Langflow CVE-2026-33017
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RIESGO
abrir ↗GitHub PoC★ 1
PoC for CVE-2025-3248: unauthenticated RCE in Langflow < 1.3.0 via /api/v1/validate/code.
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RIESGO
abrir ↗GitHub PoC★ 3
eh-amish/CVE-2026-64638-XSS-to-Shell-PoC
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RIESGO
abrir ↗GitHub PoC★ 1
Sliver HTTP(S) C2 PNG bomb DoS exploit — GHSA-663m-7x7m-g4fw (CVE-2026-77622)
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
41RIESGO
abrir ↗GitHub PoC★ 1
POC 4 CVE-2026-15038
InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
48RIESGO
abrir ↗GitHub PoC★ 2
XSS2Shell ULTIMATE v3.0 is a powerful exploitation tool that chains Cross-Site Scripting (XSS) vulnerabilities in WordPress to achieve Remote Code Execution (RCE). This tool exploits CVE-2026-64638 to gain full control over vulnerable WordPress installations.
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RIESGO
abrir ↗GitHub PoC★ 3
🔥 XSS2Shell — CVE-2026-64638 Scanner & PoC Toolkit
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.