Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.039exploits catalogados

39.796CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.790Exploit-DB 24.487GitHub PoC 16.910VulnCheck XDB 9820Nuclei 4504Metasploit 3528✓ solo verificadosrecientes populares riesgo

16.910 exploits

GitHub PoC★ 1

Technical analysis of a SharePoint ToolShell (CVE-2025-53770) exploitation attempt involving RCE, webshell deployment, and MachineKey extraction.

CVE-2025-53770CRITICALbajo ataqueransomware01 abr 2026

Microsoft SharePoint Server Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC

kavin71725/CVE-2025-12543-Fix-for-Wildfly

CVE-2025-12543CRITICAL01 abr 2026

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

48RIESGO

abrir ↗

GitHub PoC

Full penetration testing workflow: credential brute force, SSH access and privilege escalation (CVE-2021-4034)

CVE-2021-4034HIGHbajo ataqueransomware01 abr 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

abrir ↗

GitHub PoC

Hoverfly CVE RCE

CVE-2025-54123CRITICAL31 mar 2026

Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

68RIESGO

abrir ↗

GitHub PoC★ 3

Automating the exploitation of CVE-2026-7299 - Stored XSS via Database Table/Column Names in SQL Autocomplete within Appsmith =>1.99. Initial discovery 30/03/26

CVE-2026-7299MEDIUM31 mar 2026

CVE-2026-7299

33RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2022-46364 Apache CXF XOP:Include SSRF / LFI

CVE-2022-46364CRITICAL31 mar 2026

Apache CXF SSRF Vulnerability

48RIESGO

abrir ↗

GitHub PoC

kaleth4/CVE-2024-6387

CVE-2024-6387HIGH31 mar 2026

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

GitHub PoC

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-11680, a critical vulnerability in ProjectSend r1605 and earlier versions. The exploit is aimed at incorrect authentication due to problems with incorrect privilege settings and command injection.

CVE-2024-11680CRITICALbajo ataque31 mar 2026

ProjectSend Unauthenticated Configuration Modification

100RIESGO

abrir ↗

GitHub PoC

wtbacon/cve-2018-15473

CVE-2018-15473MEDIUM31 mar 2026

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati

70RIESGO

abrir ↗

GitHub PoC★ 7

Chatwoot SQL injection in FilterService

CVE-2026-44706HIGH31 mar 2026

Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values

41RIESGO

abrir ↗

GitHub PoC★ 11

Langflow RCE

CVE-2026-33017CRITICALbajo ataque31 mar 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

98RIESGO

abrir ↗

GitHub PoC

Setup and exploit recreation for CVE-2022-42889 Text4Shell.

CVE-2022-42889—30 mar 2026

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

60RIESGO

abrir ↗

GitHub PoC

CVE-2024-6387 OpenSSH 信号竞争漏洞（regreSSHion）分析报告及检测脚本

CVE-2024-6387HIGH30 mar 2026

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

GitHub PoC

CVE-2022-22947 vulnerability task

CVE-2022-22947CRITICALbajo ataque30 mar 2026

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe

100RIESGO

abrir ↗

GitHub PoC

PoC CVE-2025-54123 - Hoverfly <= 1.11.3 - Authenticated Middleware Command Injection

CVE-2025-54123CRITICAL30 mar 2026

Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

68RIESGO

abrir ↗

GitHub PoC

Apache ActiveMQ (CVE-2023-46604) zafiyetinden LockBit ransomware aşamasına uzanan 419 saatlik sızma vakasının uçtan uca analizi, SIEM korelasyon kuralları ve IOC listesi.

CVE-2023-46604CRITICALbajo ataqueransomware30 mar 2026

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RIESGO

abrir ↗

GitHub PoC

vettrivel007/CVE-2024-1086

CVE-2024-1086HIGHbajo ataqueransomware30 mar 2026

Use-after-free in Linux kernel's netfilter: nf_tables component

76RIESGO

abrir ↗

GitHub PoC★ 1

akelaqe/CVE-2024-27348-HugeGraph-RCE

CVE-2024-27348CRITICALbajo ataque30 mar 2026

Apache HugeGraph-Server: Command execution in gremlin

100RIESGO

abrir ↗

GitHub PoC

amikanev/CVE-2025-55182-LAB

CVE-2025-55182CRITICALbajo ataqueransomware30 mar 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

JacobTaylor3/CVE-2021-21220

CVE-2021-21220HIGHbajo ataque30 mar 2026

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to po

100RIESGO

abrir ↗

GitHub PoC★ 2

This vulnerability allows an attacker to perform SSRF (Server-Side Request Forgery) attacks on Apache CXF webservices that accept MTOM/XOP requests. The issue exists in how the href attribute of xop:Include is parsed, allowing arbitrary URLs to be requested by the server.

CVE-2022-46364CRITICAL29 mar 2026

Apache CXF SSRF Vulnerability

48RIESGO

abrir ↗

GitHub PoC

0x0asif/CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware29 mar 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC★ 1

Shashivanth009/CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

CVE-2022-46364CRITICAL29 mar 2026

Apache CXF SSRF Vulnerability

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-23744 - MCP Connect RCE via Unauthenticated Command Injection

CVE-2026-23744CRITICAL29 mar 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC

CVE-2025-54123 exploit and documentation

CVE-2025-54123CRITICAL29 mar 2026

Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

68RIESGO

abrir ↗

GitHub PoC★ 10

💣 Exploit for CVE-2026-26980 — 👻 Ghost CMS Unauthenticated SQLi via Content API

CVE-2026-26980CRITICAL29 mar 2026

Ghost has a SQL Injection in its Content API

63RIESGO

abrir ↗

GitHub PoC

A PoC demonstrating a RCE in Hoverfly (versions ≤ 1.11.3) by abusing the /api/v2/hoverfly/middleware endpoint and injecting a malicious middleware script

CVE-2025-54123CRITICAL28 mar 2026

Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

68RIESGO

abrir ↗

GitHub PoC

CVE-2026-25099 — Bludit CMS API Unrestricted File Upload to Remote Code Execution

CVE-2026-25099HIGH28 mar 2026

Remote Code Execution via Unrestricted File Upload in Bludit

41RIESGO

abrir ↗

GitHub PoC★ 7

CVE-2022-46364-Poc Apache CXF SSRF via MTOM XOP:Include

CVE-2022-46364CRITICAL28 mar 2026

Apache CXF SSRF Vulnerability

48RIESGO

abrir ↗

GitHub PoC

BOLA/IDOR vulnerability in osTicket ajax.tickets.php | Responsible Disclosure

CVE-2026-14871HIGH28 mar 2026

osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.