Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

80.646exploits catalogados

37.382CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.482Referência 23.825GitHub PoC 15.392VulnCheck XDB 9029Nuclei 4416Metasploit 3502✓ solo verificadosrecientes populares riesgo

80.409 exploits

GitHub PoC

Proof of Concept (PoC) exploit for CVE-2026-23744, a vulnerability affecting MCPJam Inspector that allows remote command execution (RCE) through exposed internal debugging endpoints

CVE-2026-23744CRITICAL27 mar 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

VulnCheck XDB

initial-access

CVE-2026-33017CRITICALbajo ataque26 mar 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RIESGO

GitHub PoC

Penetration test of a Drupal web app — CVE-2018-7600 (Drupalgeddon 2) exploited using Nmap, Burp Suite & Metasploit | Internship @ BB CyberSec

CVE-2018-7600CRITICALbajo ataqueransomware26 mar 2026

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RIESGO

GitHub PoC

HikvisionExploiter - это Python утилита созданная для автоматизации сканирования и проверки прямого доступа к сети камер Hikvision, нацеленная на поиск уязвимости Web interface версии 3.1.3.150324 + CVE-2021-36260

CVE-2021-36260CRITICALbajo ataque26 mar 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RIESGO

GitHub PoC★ 1

PoC for CVE-2026-23744, demonstrating an unauthenticated RCE in MCPJam Inspector (<= 1.4.2).

CVE-2026-23744CRITICAL26 mar 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

VulnCheck XDB

initial-access

CVE-2021-36260CRITICALbajo ataque26 mar 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-20282CRITICAL26 mar 2026

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

68RIESGO

GitHub PoC

Python port of the Linksys tmUnblock.cgi RCE exploit

CVE-2025-34037CRITICAL26 mar 2026

Linksys Routers E/WAG/WAP/WES/WET/WRT-Series

85RIESGO

GitHub PoC★ 1

Explore CVE-2021-44228, a vulnerability in log4j affecting almost all software under the sun.

CVE-2021-44228CRITICALbajo ataqueransomware26 mar 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC

cisco-ise rce poc

CVE-2025-20282CRITICAL26 mar 2026

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

68RIESGO

GitHub PoC

CVE-2025-64446

CVE-2025-64446CRITICALbajo ataque26 mar 2026

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

GitHub PoC★ 12

scanner/exploiter CVE-2026-24061 & CVE-2026-32746

CVE-2026-24061CRITICALbajo ataque26 mar 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking or privilege escalation.

CVE-2026-29971MEDIUM26 mar 2026

A reflected cross-site scripting (XSS) vulnerability exists in WebFileSys version before 2.32.0 and fixed in v.2.32.0. U

33RIESGO

GitHub PoC

PoC exploit for CVE-2025-34282 - ThingsBoard SSRF via SVG Image Upload

CVE-2025-34282MEDIUM26 mar 2026

ThingsBoard < v4.2.1 SVG Image SSRF

33RIESGO

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL26 mar 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

GitHub PoC

rootdirective-sec/CVE-2026-33017-Lab

CVE-2026-33017CRITICALbajo ataque26 mar 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RIESGO

VulnCheck XDB

initial-access

CVE-2019-25065MEDIUM26 mar 2026

OpenNetAdmin os command injection

48RIESGO

GitHub PoC★ 3

Apache Tomcat RCE

CVE-2025-24813CRITICALbajo ataque26 mar 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALbajo ataque26 mar 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL25 mar 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

GitHub PoC

A proof-of-concept exploit demonstrating local privilege escalation to root in sudo (CVE-2025-32463) by abusing the --chroot (-R) option and injecting a malicious NSS configuration

CVE-2025-32463CRITICALbajo ataque25 mar 2026

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

GitHub PoC

Intentionally vulnerable Next.js RSC Docker lab for CVE-2025-55182 (React2Shell) local testing

CVE-2025-55182CRITICALbajo ataqueransomware25 mar 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC★ 5

WinRAR < 7.13 path traversal for persistency

CVE-2025-8088HIGHbajo ataqueransomware25 mar 2026

Path traversal vulnerability in WinRAR

93RIESGO

GitHub PoC★ 1

Static Malware Analysis of Follina (CVE-2022-30190) from Blue Team Labs Online

CVE-2022-30190HIGHbajo ataqueransomware25 mar 2026

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RIESGO

VulnCheck XDB

local

CVE-2024-51324LOW25 mar 2026

An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via ex

28RIESGO

GitHub PoC

PoC for CVE-2025-49596 on linux targets

CVE-2025-49596CRITICAL25 mar 2026

MCP Inspector proxy server lacks authentication between the Inspector client and proxy

75RIESGO

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL25 mar 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

GitHub PoC

If you've been grinding through HackTheBox machines, Mailing is one of those boxes that genuinely teaches you something. It's rated Easy, runs on Windows, and chains together a few real-world vulnerabilities — a directory traversal, a credential leak, CVE-2024-21413, and a LibreOffice macro exploit. Let's walk through it step by step.

CVE-2024-21413CRITICALbajo ataque25 mar 2026

Microsoft Outlook Remote Code Execution Vulnerability

100RIESGO

GitHub PoC

Master's Thesis research on CVE-2024-30051 (Windows DWM Heap Overflow). Features a high-reliability exploit with automated heap spray optimization, real-time logging, and empirical success-rate analysis. Portfolio piece demonstrating advanced Windows binary exploitation, heap layout manipulation, and LPE via Desktop Window Manager.

CVE-2024-30051HIGHbajo ataqueransomware25 mar 2026

Windows DWM Core Library Elevation of Privilege Vulnerability

71RIESGO

GitHub PoC★ 1

Advanced security research on CVE-2025-55182 (React2Shell). Features an exploitation framework with 6 functional impact scenarios (RCE to Secret Exfiltration), an interactive reverse shell, and a complete laboratory. Portfolio piece demonstrating deep analysis of Prototype Pollution and Insecure Deserialization in React Server Components

CVE-2025-55182CRITICALbajo ataqueransomware25 mar 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.