Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.554exploits catalogados

39.165CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.153 exploits

GitHub PoC

Educational cyber range for CVE-2026-59827 (Metabase H2 unsafe deserialization / CWE-502). Isolated Docker lab — training only, not for attacking production Metabase.

CVE-2026-59827CRITICAL17 sep 2026

Metabase: Unsafe Deserialization of H2 Query Results

48RIESGO

GitHub PoC★ 2

CVE-2026-49179: Active Directory WriteSPNScript Command Injection

CVE-2026-49179HIGH17 sep 2026

Windows Active Directory Domain Services Remote Code Execution Vulnerability

41RIESGO

GitHub PoC

CVE-2026-85706

CVE-2026-85706CRITICALbajo ataque17 sep 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

100RIESGO

GitHub PoC★ 5

PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detection, and full exploit chain.

CVE-2026-67401CRITICAL17 sep 2026

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr

48RIESGO

GitHub PoC★ 1

CVE-2026-87930 Joomla Multi-CVE RCE suite — authorized testing only

CVE-2026-87930CRITICAL17 sep 2026

MaxSite CMS through 109.6 PHP Object Injection via ci_session

48RIESGO

GitHub PoC

CVE-2026-12793 - JetFormBuilder Unauthorized RCE (CRITICAL 9.8)

CVE-2026-12793CRITICAL17 sep 2026

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

48RIESGO

GitHub PoC★ 2

spip exploits for CVE-2026-72708, CVE-2026-72709, CVE-2026-72710

CVE-2026-72708HIGH16 sep 2026

SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

41RIESGO

GitHub PoC★ 48

container escape POCs for CVE-2026-80521 and CVE-2026-52910

CVE-2026-80521HIGH16 sep 2026

af_unix: Unlink scc_entry in unix_del_edge().

41RIESGO

GitHub PoC★ 1

Issabel pbxapi hard coded JWT RCE POC

CVE-2026-89026CRITICAL16 sep 2026

Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

48RIESGO

GitHub PoC

Langflow 1.10.0 urllib SSRF

CVE-2026-12944CRITICAL16 sep 2026

Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

48RIESGO

GitHub PoC

CVE-2014-0160 (Heartbleed) lab: vulnerable OpenSSL 1.0.1f in Docker, a memory-leak PoC, and a demo. Authorised lab use only.

CVE-2014-0160HIGHbajo ataque16 sep 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC

FabianCH20/SOC335---CVE-2024-49138-Exploitation-Detected

CVE-2024-49138HIGHbajo ataque16 sep 2026

Windows Common Log File System Driver Elevation of Privilege Vulnerability

76RIESGO

GitHub PoC★ 3

Proof of Concept and Write-up for CVE-2026-56096 (Blind Parameter Injection in TYPO3 EXT:solr)

CVE-2026-56096MEDIUM16 sep 2026

Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

33RIESGO

GitHub PoC

CVE-2021-29447 is an authenticated XML External Entity (XXE) vulnerability in WordPress

CVE-2021-29447HIGH16 sep 2026

WordPress Authenticated XXE attack when installation is running PHP 8

63RIESGO

GitHub PoC

Information on the security content of Apple software updates

CVE-2026-84600MEDIUM16 sep 2026

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS

33RIESGO

GitHub PoC★ 8

Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail

CVE-2025-32432CRITICALbajo ataque16 sep 2026

Craft CMS Allows Remote Code Execution

100RIESGO

GitHub PoC

Unofficial Apache Doris Spark connector 26.1.0 security fork for Java / Spark 3.5.1 / Scala 2.12; patched shaded Jackson for CVE-2026-54512.

CVE-2026-54512HIGH16 sep 2026

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

41RIESGO

GitHub PoC

avergnaud/flight-sql-jdbc-driver-cve-2026-54512

CVE-2026-54512HIGH16 sep 2026

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

41RIESGO

GitHub PoC

CVE-2026-65374 - Draft or TODO

CVE-2026-65374HIGH16 sep 2026

A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Seq

41RIESGO

GitHub PoC★ 11

research on finding the bug and fix of CVE-2026-84616 and CVE-2026-84607

CVE-2026-84616MEDIUM16 sep 2026

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS

33RIESGO

GitHub PoC

rootxn/CVE-2026-12793

CVE-2026-12793CRITICAL16 sep 2026

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

48RIESGO

GitHub PoC

CVE-2026-5430 - Draft or TODO

CVE-2026-5430CRITICALbajo ataque16 sep 2026

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

78RIESGO

GitHub PoC

shivammittal2403/cve-2026-80428-ctf

CVE-2026-80428CRITICAL16 sep 2026

ILIAS PHP Object Injection via Shibboleth Logout

48RIESGO

GitHub PoC★ 5

CVE-2026-12793 PoC — JetFormBuilder ≤3.6.2 unauth Register User / admin account creation

CVE-2026-12793CRITICAL16 sep 2026

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

48RIESGO

GitHub PoC★ 1

My first CVE

CVE-2026-65330MEDIUM16 sep 2026

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoi

33RIESGO

GitHub PoC

0xgh0stri13y/CVE-2026-109519

CVE-2026-109519MEDIUM16 sep 2026

YouTransfer Template Rendering template path traversal

33RIESGO

GitHub PoC★ 1

Proof-of-Concept for CVE-2026-92680, the insecurely protected credentials vulnerability affecting Araxis Merge.

CVE-2026-92680MEDIUM16 sep 2026

Araxis Merge insufficiently protected credentials

33RIESGO

GitHub PoC★ 526

A cPanel and WHM authentication bypassing tool

CVE-2026-41940CRITICALbajo ataqueransomware16 sep 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC

CVE-2026-15315, CVE-2026-15316 - Draft or TODO

CVE-2026-15315HIGH15 sep 2026

Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200

41RIESGO

GitHub PoC

isaca0315/CVE-2026-65013-BOLA-IDOR

CVE-2026-65013HIGH15 sep 2026

Onlook tRPC Insecure Direct Object Reference via multiple procedures

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.