Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.337exploits catalogados

39.873CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 25.822Exploit-DB 24.487GitHub PoC 17.115VulnCheck XDB 9874Nuclei 4511Metasploit 3528✓ solo verificadosrecientes populares riesgo

17.115 exploits

GitHub PoC

A detailed penetration testing walkthrough and exploitation report for the 'Portal' machine, focusing on CVE-2011-2523 (vsFTPd 2.3.4 Backdoor) to achieve root access.

CVE-2011-2523—21 mar 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

GitHub PoC★ 1

The vulnerability in Langflow 1.8.1 and earlier allows a remote, unauthenticated attacker to achieve arbitrary command execution on the host.

CVE-2026-33017CRITICALbajo ataque21 mar 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

98RIESGO

GitHub PoC

Resonant RCE for CVE-2026-33017 via CTT Phase-Lock. Exploits Langflow build_public_tmp flow_id endpoint. Bypasses auth using 34th-layer negative refraction to inject Python exec() payloads. Calibrated for 16.6fs jitter resonance and g-coupling g \approx 0.733. O(log N) collapse of AI supply chain security.

CVE-2026-33017CRITICALbajo ataque21 mar 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

98RIESGO

GitHub PoC

SALMA-ESSAOUD/CVE-CVSS--CVE-2024-38063-IPv6-TCP-IP-Remote-Code-Execution-Analysis

CVE-2024-38063CRITICAL21 mar 2026

Windows TCP/IP Remote Code Execution Vulnerability

70RIESGO

GitHub PoC★ 10

CVE-2026-33017 - An unauthenticated remote code execution in Langflow <= 1.8.1 via Public Flow Build Endpoint

CVE-2026-33017CRITICALbajo ataque21 mar 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

98RIESGO

GitHub PoC★ 12

MCPJam inspector contains a remote code execution

CVE-2026-23744CRITICAL21 mar 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

GitHub PoC

danilo1992-sys/CVE-2021-29447

CVE-2021-29447HIGH20 mar 2026

WordPress Authenticated XXE attack when installation is running PHP 8

63RIESGO

GitHub PoC

chosenonehacks/CVE-2026-32746

CVE-2026-32746CRITICAL20 mar 2026

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption

48RIESGO

GitHub PoC

danindiana/cve-2026-32746-mitigation

CVE-2026-32746CRITICAL20 mar 2026

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption

48RIESGO

GitHub PoC

Langflow at pre-CVE-2025-3248 fix commit for variant analysis benchmarking

CVE-2025-3248CRITICALbajo ataqueransomware20 mar 2026

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RIESGO

GitHub PoC

CVE-2025-6934 Exploit Tool Unauthenticated Administrator Account Creation in WordPress Plugin Opal Estate Pro

CVE-2025-6934CRITICAL20 mar 2026

Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'

68RIESGO

GitHub PoC

havertz2110/CVE-2024-48510-PoC

CVE-2024-48510CRITICAL19 mar 2026

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code vi

48RIESGO

GitHub PoC★ 1

Classic stack-based buffer overflow in Savant Web Server 3.1 demonstrating early-2000s remote memory corruption through a crafted HTTP request.

CVE-2002-1120—19 mar 2026

Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP G

50RIESGO

GitHub PoC

Exploit based in /jaiguptanick/CVE-2019-0232

CVE-2019-0232—19 mar 2026

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RIESGO

GitHub PoC

duduLiu8787/CVE-2026-32746-Exploit

CVE-2026-32746CRITICAL19 mar 2026

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption

48RIESGO

GitHub PoC

tayW84/CVE-2019-10945----Python3

CVE-2019-10945—19 mar 2026

An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder param

35RIESGO

GitHub PoC★ 1

Classic stack-based buffer overflow in SLMail 5.1 showing how early mail servers could be compromised through oversized SMTP and POP3 commands.

CVE-2003-0264—19 mar 2026

Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO arg

60RIESGO

GitHub PoC

SEH-based buffer overflow in Easy File Sharing Web Server 7.2, reachable through the password recovery endpoint.

CVE-2025-34096CRITICAL19 mar 2026

Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghp

63RIESGO

GitHub PoC★ 1

Classic stack-based buffer overflow in War FTP Daemon 1.65 demonstrating old-school remote code execution through malformed FTP commands.

CVE-2007-1567—19 mar 2026

Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of s

35RIESGO

GitHub PoC

Performing multiple time-based blind injections for the same character and selecting the most frequent result significantly reduces errors and improves reliability, through it is time-consuming.

CVE-2024-51482CRITICAL19 mar 2026

Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64

75RIESGO

GitHub PoC

vsftpd 2.3.4 Backdoor Exploit (CVE-2011-2523)

CVE-2011-2523—19 mar 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

GitHub PoC

POC for CVE-2021-3156 - Heap-based buffer overflow in sudo

CVE-2021-3156HIGHbajo ataque19 mar 2026

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

GitHub PoC★ 1

PoC Magento Session Reaper - CVE-2025-54236

CVE-2025-54236CRITICALbajo ataque19 mar 2026

Adobe Commerce | Improper Input Validation (CWE-20)

100RIESGO

GitHub PoC

CVE-2026-24061 PoC - telnetd auth bypass

CVE-2026-24061CRITICALbajo ataque18 mar 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

A professional Python tool designed for educational penetration testing, demonstrating SSH vulnerabilities (CVE-2008-0166 / CVE-2008-1657) with interactive shell access, command logging, and automated PDF/DOCX reporting.

CVE-2008-0166—18 mar 2026

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge

45RIESGO

GitHub PoC

jesusdominguez87/CVE-2025-5548

CVE-2025-5548MEDIUM18 mar 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RIESGO

GitHub PoC

Practical lab focused on vulnerability analysis and exploit development, using FreeFloat FTP Server 1.0 as an educational buffer overflow case study and documenting the setup, analysis and exploitation workflow

CVE-2025-5548MEDIUM18 mar 2026

FreeFloat FTP Server NOOP Command buffer overflow

38RIESGO

GitHub PoC

A professional Python tool designed for educational penetration testing, demonstrating SSH vulnerabilities (CVE-2008-0166 / CVE-2008-1657) with interactive shell access, command logging, and automated PDF/DOCX reporting.

CVE-2008-0166—18 mar 2026

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge

45RIESGO

GitHub PoC★ 30

CVE-2026-32746 - GNU InetUtils telnetd LINEMODE SLC Buffer Overflow PoC (pre-auth RCE, CVSS 9.8)

CVE-2026-32746CRITICAL18 mar 2026

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption

48RIESGO

GitHub PoC

CVE-2024-53677 취약점 분석 보고서

CVE-2024-53677CRITICAL18 mar 2026

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

70RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.