Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.566exploits catalogados

39.907CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 25.846Exploit-DB 24.488GitHub PoC 17.314VulnCheck XDB 9877Nuclei 4513Metasploit 3528✓ solo verificadosrecientes populares riesgo

17.314 exploits

GitHub PoC

Baza-NATO/CVE-2021-33044

CVE-2021-33044CRITICALbajo ataque25 ene 2026

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-21876 OWASP ModSecurity CRS WAF bypass (docker container + minimal PoC).

CVE-2026-21876CRITICAL25 ene 2026

OWASP CRS has multipart bypass using multiple content-type parts

53RIESGO

abrir ↗

GitHub PoC★ 4

POC (RCE) -> CVE-2019-9978

CVE-2019-9978MEDIUMbajo ataque25 ene 2026

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RIESGO

abrir ↗

GitHub PoC★ 2

This script exploits an SQL Injection vulnerability in WordPress Quiz Maker plugin (≤ 6.7.0.56) by injecting payloads via an HTTP header (default: X-Forwarded-For).

CVE-2025-10042MEDIUM25 ene 2026

Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection

33RIESGO

abrir ↗

GitHub PoC

Python demo simulating CVE-2024-3094: a supply chain backdoor in XZ Utils with a trigger-based stealth activation.

CVE-2024-3094CRITICAL25 ene 2026

Xz: malicious code in distributed source

70RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2015-2291 Local Privilege Escalation PoC

CVE-2015-2291HIGHbajo ataqueransomware25 ene 2026

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows all

71RIESGO

abrir ↗

GitHub PoC

jagg3rsec/CVE-2014-6287

CVE-2014-6287CRITICALbajo ataque25 ene 2026

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RIESGO

abrir ↗

GitHub PoC

CVE-2025-64155

CVE-2025-64155CRITICAL25 ene 2026

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet

60RIESGO

abrir ↗

GitHub PoC

dionissh/CVE-2024-21413

CVE-2024-21413CRITICALbajo ataque25 ene 2026

Microsoft Outlook Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-24061 PoC

CVE-2026-24061CRITICALbajo ataque25 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

GNU telnetd service from GNU InetUtils authentication-bypass

CVE-2026-24061CRITICALbajo ataque25 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque25 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-24061 - GNU InetUtils telnetd authentication bypass POC + Docker lab environment for testing

CVE-2026-24061CRITICALbajo ataque24 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

BrainBob/Telnet-TestVuln-CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque24 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

GNU Inetutils telnetd Remote Authentication Bypass

CVE-2026-24061CRITICALbajo ataque24 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

BrainBob/CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque24 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC★ 1

Nuclei template for CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque24 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

ranasen-rat/cve-2021-42013

CVE-2021-42013CRITICALbajo ataqueransomware24 ene 2026

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2026-24061 - GNU InetUtils Telnetd Remote Authentication Bypass

CVE-2026-24061CRITICALbajo ataque24 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

For HTB practice

CVE-2022-44268MEDIUM24 ene 2026

ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulti

55RIESGO

abrir ↗

GitHub PoC★ 4

Docker setup for CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque24 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

xitexploiter96-dot/CVE-2023-38408

CVE-2023-38408CRITICAL24 ene 2026

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot

70RIESGO

abrir ↗

GitHub PoC★ 9

CVE-2026-24061's poc : a critical authentication bypass in telnetd leading to RCE as root Affects systems with telnetd versions containing the vulnerability from 2015 onwards.

CVE-2026-24061CRITICALbajo ataque24 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC★ 1

A secure, zero-trust database management tool for WordPress. Fixes critical SSRF vulnerabilities (CVE-2021-21311) by enforcing local connections only.

CVE-2021-21311HIGHbajo ataque24 ene 2026

SSRF in adminer

100RIESGO

abrir ↗

GitHub PoC

z3n70/CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque24 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC★ 6

Proof of Concept: CVE-2026-24061 is a critical authentication bypass vulnerability in GNU inetutils-telnetd allowing unauthenticated remote attackers to gain instant root shell access via malicious NEW_ENVIRON telnet option exploitation.

CVE-2026-24061CRITICALbajo ataque23 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-24061 环境

CVE-2026-24061CRITICALbajo ataque23 ene 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC★ 2

Sairbo/Unihackers---CVE-2025-55182-

CVE-2025-55182CRITICALbajo ataqueransomware23 ene 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC★ 2

The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the `kubio_hybrid_theme_load_template` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files..

CVE-2025-2294CRITICAL23 ene 2026

Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion

85RIESGO

abrir ↗

GitHub PoC

Replica of CVE-2019-15715 in Python3

CVE-2019-15715—23 ene 2026

MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.

35RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.