Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.644exploits catalogados
40.922CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.560Exploit-DB 24.489GitHub PoC 18.407VulnCheck XDB 11.064Nuclei 4584Metasploit 3540✓ solo verificadosrecientespopularesriesgo
88.162 exploits
GitHub PoC★ 2
HTTP/2 Bomb (CVE-2026-49975) non-destructive vulnerability detector for Nginx / Apache httpd. Zero-dependency Python.
Apache HTTP Server: mod_http2 denial of service
53RIESGO
abrir ↗GitHub PoC
webshellseo8/CVE-2026-1555-POC
WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload
48RIESGO
abrir ↗GitHub PoC
CVE-2018-9276 — PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra
100RIESGO
abrir ↗GitHub PoC
Remote Code Execution in DbGate via functionName injection in the loadReader endpoint — CVSS 8.8
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
41RIESGO
abrir ↗GitHub PoC
Some labs looking at the xz backdoor vulnerability (CVE-2024-3094)
Xz: malicious code in distributed source
70RIESGO
abrir ↗VulnCheck XDB
initial-access
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗GitHub PoC
A lightweight stdio-based MCP server for local file system operations — read, write, edit, search, exec for AI assistants. Specially optimized for Chatbox: bat-bypass for exec (CVE-2026-6130), b64 encoding to eliminate escaping issues, and multi-pattern regex for precise code block targeting.
chatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injection
33RIESGO
abrir ↗GitHub PoC★ 2
CVE-2021-21425 - GravCMS 1.10.7 Unauthenticated RCE via Scheduler. Improved exploit with CLI args and auto base64 encoding.
Unauthenticated Arbitrary YAML Write/Update leads to Code Execution
85RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
redis-server RESTORE invalid memory access may allow remote code execution
41RIESGO
abrir ↗GitHub PoC★ 1
ExifTool arbitrary code execution via a crafted DjVu image (versions 7.44 to 12.23). PoC builds a pure DjVu payload with djvumake, so the attacker machine needs no vulnerable ExifTool.
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RIESGO
abrir ↗VulnCheck XDB
local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RIESGO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
JupyterHub XSRF bypass via cross-origin form POST (Sec-Fetch-Mode: no-cors) — CWE-352
JupyterHub: Cross-origin form POSTs bypass XSRF
33RIESGO
abrir ↗GitHub PoC
CyruxSec/CVE-2026-4524
Authentication Bypass Using an Alternate Path or Channel in GitLab
33RIESGO
abrir ↗GitHub PoC
CVE-2018-9276 — PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra
100RIESGO
abrir ↗GitHub PoC
CVE-2025-55182 exploit script
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-6279
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
63RIESGO
abrir ↗GitHub PoC★ 3
HTTP/2 Bomb (CVE-2026-49975) non-destructive vulnerability detector for Nginx / Apache httpd. Zero-dependency Python.
Apache HTTP Server: mod_http2 denial of service
53RIESGO
abrir ↗GitHub PoC★ 1
HTTP/2 Bomb: HPACK indexed-reference amplification + flow-control stall. A high school student's full protocol analysis (LaTeX). CVE-2026-49975, CVE-2026-47774.
Apache HTTP Server: mod_http2 denial of service
53RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra
100RIESGO
abrir ↗GitHub PoC
87achrafg-stack/CVE-2026-6279
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
63RIESGO
abrir ↗GitHub PoC
Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
48RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-25089
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
100RIESGO
abrir ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC★ 4
Toolkit for CVE-2025-55182, also known as React2Shell.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC★ 1
Chains CVE-2025-57819 (stacked query SQL injection) and CVE-2025-61678 (authenticated file upload in FreePBX Endpoint Manager) to achieve Remote Code Execution (RCE). For educational use only.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗Metasploit600
SimpleHelp OIDC Authentication Bypass Remote Code Execution
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
100RIESGO
abrir ↗GitHub PoC★ 4
CVE-2026-35273
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana
100RIESGO
abrir ↗GitHub PoC
rootdirective-sec/CVE-2026-46645-Analysis-Lab
SQLAdmin: Authorization Bypass on `ajax_lookup`
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.