Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
88.056 exploits
GitHub PoC
Reproducible SOC lab for CVE-2024-4577 detection and response
Argument Injection in PHP-CGI
100RIESGO
abrir ↗GitHub PoC
webshellseo8/CVE-2026-61511-POC
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
63RIESGO
abrir ↗GitHub PoC
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
63RIESGO
abrir ↗GitHub PoC★ 6
CVE-2026-61511 – vBulletin Pre-Auth RCE (CVSS 9.8). Vuln 5.x/6.x (unpatched). Multi-exploit via Endpoint Pool, AJAX, PHPFuck WAF bypass. Full toolkit: reverse shell, proxy, persistence, webshell, database operations, firewall control, log management, mass scanning. 2 versions: multi-exploit & safe-check. Python 3.8+ Use Ethically, Stay Legal.
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
63RIESGO
abrir ↗GitHub PoC
Tracking OVSwrap (CVE-2026-64531), the Open vSwitch datapath netlink overflow
net: openvswitch: reject oversized nested action attrs
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-66066
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
75RIESGO
abrir ↗GitHub PoC
CamilleGR/CVE-2026-73292
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
41RIESGO
abrir ↗GitHub PoC
Simulated a real-world attack (CVE-2011-2523) against a vulnerable host, then cross-checked detection coverage against an existing Wazuh/Suricata/Zeek SOC — uncovering and fixing 5 real monitoring pipeline bugs along the way.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗GitHub PoC★ 3
cve-2026-61511
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
63RIESGO
abrir ↗GitHub PoC★ 7
Security research on Liferay CE 7.0.3 GA4: pre-auth RCE as root (CVE-2020-7961 class) reproduced end-to-end, plus 16 more findings — 8+ with no known CVE. Agentic loop-hunt: 25 generators, 22 judges, 9 live validators on Docker. Evidence trail + one-go checker included.
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RIESGO
abrir ↗GitHub PoC★ 6
CVE-2026-53921 – odhcpd Stack Overflow (CVSS 9.8) Vuln detailed and comprehensive Write-Up and Verifier & Multi-exploit for OpenWrt DHCPv6 RCE. Dual-vector (IA_NA/IA_PD) overflow with MIPS/ARM shellcode, ROP chains, SOCKS5 proxy, persistence, log wiping & mass scanning. Use Ethically, Stay Legal.
odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
48RIESGO
abrir ↗GitHub PoC
0xdak/CVE-2025-71389_exploit
Cal.com before 5.9.9 Remote Code Execution via RSC
48RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-53921
odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
48RIESGO
abrir ↗GitHub PoC
CVE-2026-61511 - Draft or Todo
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
63RIESGO
abrir ↗GitHub PoC
CVE-2026-14856 TastyIgniter v4.3.0
Stored Cross-Site Scripting (XSS) in TastyIgniter Media Manager
33RIESGO
abrir ↗VulnCheck XDB
initial-access
Microsoft SharePoint Server Security Feature Bypass Vulnerability
100RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-53264 - Draft or Todo
net/sched: act_api: use RCU with deferred freeing for action lifecycle
41RIESGO
abrir ↗GitHub PoC
CVE-2023-23752 Urban Transit Infrastructure Security Audit, CVSS 9.8 Attack Chain Analysis & Blue-Team Remediation Lab
[20230201] - Core - Improper access check in webservice endpoints
100RIESGO
abrir ↗GitHub PoC★ 3
Exploit code for CVE-2026-55040, it can create auth header for any validate account.
Microsoft SharePoint Server Security Feature Bypass Vulnerability
100RIESGO
abrir ↗GitHub PoC★ 10
KSU installer for supported firmware with CVE-2026-43499
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
CyberVinner/CP-PLUS-EZ-P21-CVE-2026-65893-65894
Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera
41RIESGO
abrir ↗GitHub PoC★ 4
KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
bha-vin/CVE-2026-64600-Exploit
xfs: resample the data fork mapping after cycling ILOCK
41RIESGO
abrir ↗GitHub PoC
letsr00t/RefluxFS_CVE-2026-64600
xfs: resample the data fork mapping after cycling ILOCK
41RIESGO
abrir ↗VulnCheck XDB
initial-access
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
63RIESGO
abrir ↗GitHub PoC★ 1
IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution [RCE]
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RIESGO
abrir ↗VulnCheck XDB
initial-access
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
48RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.