Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.337exploits catalogados

39.873CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 25.822Exploit-DB 24.487GitHub PoC 17.115VulnCheck XDB 9874Nuclei 4511Metasploit 3528✓ solo verificadosrecientes populares riesgo

17.115 exploits

GitHub PoC★ 2

AsyncIO Scanner & Exploitation Framework for CVE-2026-24061 (Telnet NEW_ENVIRON Auth Bypass). Features high-concurrency discovery, passive fingerprinting, and authorized root shell escalation

CVE-2026-2406MEDIUM30 ene 2026

IDOR in Universe Software's Online Registration and Workflow Management System

33RIESGO

GitHub PoC

afifudinmtop/CVE-2021-43857-Gerapy-v0.9.7

CVE-2021-43857CRITICAL30 ene 2026

Gerapy may contain remote code execution vulnerability

60RIESGO

GitHub PoC

CTT-Terrminus-Vortex (CVE-2026-2406)

CVE-2026-2406MEDIUM30 ene 2026

IDOR in Universe Software's Online Registration and Workflow Management System

33RIESGO

GitHub PoC★ 1

webkit_refraction.js (The 33-Layer WebGL Payload) This JavaScript payload uses the \alpha constant to create a high-frequency "Memory Shiver." It induces the Use-After-Free (UAF) in CVE-2025-43529 by desynchronizing the WebKit garbage collector from the GPU's Metal command buffer.

CVE-2025-43529HIGHbajo ataque30 ene 2026

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

71RIESGO

GitHub PoC★ 30

An uninitialized read vulnerability by incorrect Turboshaft Store-Store Elimination in V8.

CVE-2025-5419HIGHbajo ataque29 ene 2026

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially expl

71RIESGO

GitHub PoC

CVE-2020-11107-Local-Privilege-Escalation-XAMPP-7.2.29-7.3.x-7.3.16-7.4.x-7.4.4

CVE-2020-11107—29 ene 2026

An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged

28RIESGO

GitHub PoC★ 1

Metasploitable 2 üzerinde vsftpd 2.3.4 (CVE-2011-2523) zafiyetinin istismarı ve sızma sonrası adımlarını içeren laboratuvar çalışması.

CVE-2011-2523—29 ene 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

GitHub PoC

Proof of concept for CVE-2019-11707

CVE-2019-11707HIGHbajo ataque29 ene 2026

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow

83RIESGO

GitHub PoC

HP Power Manager 4.2 (Build 7) exploit

CVE-2009-3999—29 ene 2026

Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to ex

60RIESGO

GitHub PoC★ 1

imbas007/auth-bypass-CVE-2025-40554

CVE-2025-40554CRITICAL29 ene 2026

SolarWinds Web Help Desk Authentication Bypass Vulnerability

75RIESGO

GitHub PoC

deepankarkumar1/CVE-2025-55182_Vulnerable-Application

CVE-2025-55182CRITICALbajo ataqueransomware29 ene 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

Very rough PoC for detecting/reproducing CVE-2022-0847 (dirty pipe) through random generation of syscalls and differential fuzzing against a model.

CVE-2022-0847HIGHbajo ataque28 ene 2026

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RIESGO

GitHub PoC

22imer/CVE-2014-0160

CVE-2014-0160HIGHbajo ataque28 ene 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC

CVE-2026-24061 Telnet RCE Exploit For Linux MacOS Windows

CVE-2026-24061CRITICALbajo ataque28 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

Lab to show the CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque28 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

Parad0x7e/CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque28 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC★ 1

Checks for CVE-2026-24061 Telnetd exploit

CVE-2026-24061CRITICALbajo ataque28 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC★ 1

CTT-Enhanced iOS Safari Exploit (based on CVE-2025-43529)

CVE-2025-43529HIGHbajo ataque28 ene 2026

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

71RIESGO

GitHub PoC

Heartbleed (CVE-2014-0160) was devastating because it leaked adjacent memory. CTT-Heartbleed goes further—it uses 33-layer temporal resonance to map, reconstruct, and extract specific memory regions across time, not just adjacent buffers.

CVE-2014-0160HIGHbajo ataque28 ene 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC

Clarification Regarding the Rejection Arguments

CVE-2025-56005CRITICAL28 ene 2026

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the

53RIESGO

GitHub PoC

WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

CVE-2021-24499—28 ene 2026

Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

50RIESGO

GitHub PoC★ 5

用于借助FOFA快速测试海康威视的CVE-2017-7921漏洞，并且给出登陆账号和密码，并输出json文件。

CVE-2017-7921CRITICALbajo ataque28 ene 2026

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16

100RIESGO

GitHub PoC★ 1

CTT-enhanced version of the Microsoft Exchange Server SSRF to RCE exploit (ProxyShell/ProxyLogon), another CVSS 10.0 critical vulnerability that affected hundreds of thousands of organizations worldwide.

CVE-2021-26855CRITICALbajo ataqueransomware28 ene 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

100RIESGO

GitHub PoC★ 1

GNU Inetutils telnet远程认证绕过漏洞(CVE-2026-24061)，该漏洞源于 GNU Inetutils telnetd 组件中对环境变量处理不当，攻击者可利用该漏洞，通过构造恶意的 USER 环境变量并发送至受影响的 telnet 服务，触发认证绕过机制，进而实现无需密码直接获取root权限。

CVE-2026-24061CRITICALbajo ataque28 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

androidteacher/CVE-2026-24061-PoC-Telnetd

CVE-2026-24061CRITICALbajo ataque27 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC★ 1

FurkanKAYAPINAR/CVE-2026-24061-telnet2root

CVE-2026-24061CRITICALbajo ataque27 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

Simple and effective PoC for CVE-2021-43798 Grafana Path Traversal

CVE-2021-43798HIGHbajo ataque27 ene 2026

Grafana path traversal

100RIESGO

GitHub PoC★ 4

This is a security exploit tool targeting CVE-2025-55182. It exploits a Remote Code Execution (RCE) vulnerability in React Server Components

CVE-2025-55182CRITICALbajo ataqueransomware27 ene 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

Sn0wBaall/CVE-2024-23334-PoC

CVE-2024-23334MEDIUM27 ene 2026

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

70RIESGO

GitHub PoC

androidteacher/CVE-2024-50498-wpquery

CVE-2024-50498CRITICAL27 ene 2026

WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

75RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.