Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
85.566exploits catalogados
39.907CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.846Exploit-DB 24.488GitHub PoC 17.314VulnCheck XDB 9877Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
17.314 exploits
GitHub PoC★ 3
Exploiting CVE-2022-0847 - written by : Antonius (w1sdom)
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RIESGO
abrir ↗GitHub PoC★ 27
This Python PoC exploits CVE-2024-46987, a Path Traversal bug in Camaleon CMS 2.8.0 < 2.8.2 (work on 2.9.0). It allows authenticated users to read sensitive server files via the MediaController. Intended for authorized security auditing and educational research only.
Arbitrary path traversal in Camaleon CMS
61RIESGO
abrir ↗GitHub PoC★ 17
Root Cause Analysis for CVE-2025-43529, a UAF vulnerability due to incorrect DFG StoreBarrierInsertionPhase in JavaScriptCore.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
71RIESGO
abrir ↗GitHub PoC★ 2
POC Script for CVE-2026-24061 (GNU Telnetd Exploit)
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗GitHub PoC
Submodule repo for Backup Exec CVE-2024-32002 exploit
Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
53RIESGO
abrir ↗GitHub PoC
Superproject repo for Backup Exec CVE-2025-48384 exploit
Git allows arbitrary code execution through broken config quoting
71RIESGO
abrir ↗GitHub PoC
React2shell exploit (CVE-2025-55182+CVE-2025-66478)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
mbanyamer/deephas-1.0.7-Prototype-Pollution-PoC-CVE-2026-25047-
deepHas vulnerable to Prototype Pollution via constructor.prototype
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2025-40554 Exploitation
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RIESGO
abrir ↗GitHub PoC
Scanner for CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗GitHub PoC★ 1
This is a simple PoC that allows you to highlight the severity of the ongoing and actively exploited Telnet bug that is going on right now. Why people are still using Telnet... beyond me.
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗GitHub PoC
Superproject repo for Backup Exec CVE-2024-32002 exploit
Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
53RIESGO
abrir ↗GitHub PoC★ 3
1atakan1/CVE-2025-6934
Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
68RIESGO
abrir ↗GitHub PoC
afifudinmtop/CVE-2021-43857-Gerapy-v0.9.7
Gerapy may contain remote code execution vulnerability
60RIESGO
abrir ↗GitHub PoC★ 1
webkit_refraction.js (The 33-Layer WebGL Payload) This JavaScript payload uses the \alpha constant to create a high-frequency "Memory Shiver." It induces the Use-After-Free (UAF) in CVE-2025-43529 by desynchronizing the WebKit garbage collector from the GPU's Metal command buffer.
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
71RIESGO
abrir ↗GitHub PoC★ 2
AsyncIO Scanner & Exploitation Framework for CVE-2026-24061 (Telnet NEW_ENVIRON Auth Bypass). Features high-concurrency discovery, passive fingerprinting, and authorized root shell escalation
IDOR in Universe Software's Online Registration and Workflow Management System
33RIESGO
abrir ↗GitHub PoC
CTT-Terrminus-Vortex (CVE-2026-2406)
IDOR in Universe Software's Online Registration and Workflow Management System
33RIESGO
abrir ↗GitHub PoC★ 1
Metasploitable 2 üzerinde vsftpd 2.3.4 (CVE-2011-2523) zafiyetinin istismarı ve sızma sonrası adımlarını içeren laboratuvar çalışması.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗GitHub PoC
deepankarkumar1/CVE-2025-55182_Vulnerable-Application
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
HP Power Manager 4.2 (Build 7) exploit
Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to ex
60RIESGO
abrir ↗GitHub PoC★ 1
imbas007/auth-bypass-CVE-2025-40554
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RIESGO
abrir ↗GitHub PoC
CVE-2020-11107-Local-Privilege-Escalation-XAMPP-7.2.29-7.3.x-7.3.16-7.4.x-7.4.4
An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged
28RIESGO
abrir ↗GitHub PoC★ 30
An uninitialized read vulnerability by incorrect Turboshaft Store-Store Elimination in V8.
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially expl
71RIESGO
abrir ↗GitHub PoC
Proof of concept for CVE-2019-11707
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow
83RIESGO
abrir ↗GitHub PoC
CVE-2026-24061 Telnet RCE Exploit For Linux MacOS Windows
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗GitHub PoC★ 1
CTT-Enhanced iOS Safari Exploit (based on CVE-2025-43529)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
71RIESGO
abrir ↗GitHub PoC★ 1
GNU Inetutils telnet远程认证绕过漏洞(CVE-2026-24061)，该漏洞源于 GNU Inetutils telnetd 组件中对环境变量处理不当，攻击者可利用该漏洞，通过构造恶意的 USER 环境变量并发送至受影响的 telnet 服务，触发认证绕过机制，进而实现无需密码直接获取root权限。
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗GitHub PoC★ 5
用于借助FOFA快速测试海康威视的CVE-2017-7921漏洞，并且给出登陆账号和密码，并输出json文件。
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RIESGO
abrir ↗GitHub PoC
Heartbleed (CVE-2014-0160) was devastating because it leaked adjacent memory. CTT-Heartbleed goes further—it uses 33-layer temporal resonance to map, reconstruct, and extract specific memory regions across time, not just adjacent buffers.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RIESGO
abrir ↗GitHub PoC
WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
50RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.