Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.644exploits catalogados
40.922CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.560Exploit-DB 24.489GitHub PoC 18.407VulnCheck XDB 11.064Nuclei 4584Metasploit 3540✓ solo verificadosrecientespopularesriesgo
88.644 exploits
Metasploit600
SimpleHelp OIDC Authentication Bypass Remote Code Execution
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
100RIESGO
abrir ↗GitHub PoC★ 1
Safely detect whether a SolarWinds Serv-U host is vulnerable to CVE-2026-28318
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
83RIESGO
abrir ↗GitHub PoC★ 11
An offensive security researcher + an AI vs. a fresh n-day: building the first public PoC for CVE-2026-53435 in one Friday night. Raw 8h20m log inside.
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrar
53RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-25089
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
100RIESGO
abrir ↗GitHub PoC★ 1
Chains CVE-2025-57819 (stacked query SQL injection) and CVE-2025-61678 (authenticated file upload in FreePBX Endpoint Manager) to achieve Remote Code Execution (RCE). For educational use only.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-50751 — Check Point IKEv1 Authentication Bypass
User Authentication Bypass in VPN Remote Access and Mobile Access
100RIESGO
abrir ↗GitHub PoC★ 1
upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution
upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution
41RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-48907
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗GitHub PoC★ 1
FOSSBilling CVE-2026-53647 & CVE-2026-53646 PoC — Unauthenticated API key disclosure & password reset token reuse
FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint
33RIESGO
abrir ↗GitHub PoC
Cisco Unified Communications Manager (Unified CM) deployments affected by CVE-2026-20230.
Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
93RIESGO
abrir ↗GitHub PoC
CVE-2026-49777 - ShapedPlugin Product Slider Pro for WooCommerce Backdoor RCE
WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability
63RIESGO
abrir ↗GitHub PoC
CVE-2026-0273 - Draft
PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI
33RIESGO
abrir ↗GitHub PoC★ 4
Toolkit for CVE-2025-55182, also known as React2Shell.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
48RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-48907
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗GitHub PoC★ 16
PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5 unauthenticated RCE
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗GitHub PoC★ 1
Lab + writeup for CVE-2026-28699: Gitea OAuth2 scope enforcement bypass via HTTP Basic auth
Gitea Basic Auth bypasses OAuth2 access token scopes
41RIESGO
abrir ↗GitHub PoC
leehunkoo/cve-2013-4660_PoC
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
43RIESGO
abrir ↗VulnCheck XDB
local
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
68RIESGO
abrir ↗GitHub PoC
CVE-2026-10795 The UpdraftPlus POC
UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
41RIESGO
abrir ↗GitHub PoC
FangFang-Yi/CVE-2024-30088
Windows Kernel Elevation of Privilege Vulnerability
83RIESGO
abrir ↗GitHub PoC★ 39
A demonstration of read write using cve-2025-43529 on iOS 26.1
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
76RIESGO
abrir ↗GitHub PoC
CVE-2026-50507 - Draft
Windows BitLocker Security Feature Bypass Vulnerability
33RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability
68RIESGO
abrir ↗GitHub PoC
From deobfuscating code.js to root, CVE-2023-0386
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa
86RIESGO
abrir ↗VulnCheck XDB
info-leak
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
76RIESGO
abrir ↗VulnCheck XDB
initial-access
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
100RIESGO
abrir ↗GitHub PoC
Cyber-DarkNay/CVE-2026-7458
User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-11645
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitra
71RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.