Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.644exploits catalogados
40.922CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.560Exploit-DB 24.489GitHub PoC 18.407VulnCheck XDB 11.064Nuclei 4584Metasploit 3540✓ solo verificadosrecientespopularesriesgo
88.644 exploits
VulnCheck XDB
initial-access
Langflow - Path Traversal Arbitrary File Write via upload_user_file
68RIESGO
abrir ↗GitHub PoC
CVE-2026-48962 - IO::Compress - Code Execution
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob
41RIESGO
abrir ↗GitHub PoC★ 1
OSCP like CVE-2025-24893 exploit for Linux XWiki
Remote code execution as guest via SolrSearchMacros request in xwiki
100RIESGO
abrir ↗GitHub PoC
WORDPRESS
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
56RIESGO
abrir ↗GitHub PoC★ 3
PoC de CVE-2026-11645: lectura/escritura fuera de limites en Chrome V8 (CVSS 8.8).
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitra
71RIESGO
abrir ↗GitHub PoC
1-day exploit for CVE-2026-45258
Multiple vulnerabilities in the sound(4) mmap path
41RIESGO
abrir ↗GitHub PoC★ 6
watchtowrlabs/watchTowr-vs-Check-Point-CVE-2026-50751
User Authentication Bypass in VPN Remote Access and Mobile Access
100RIESGO
abrir ↗GitHub PoC★ 6
CVE-2026-25089 - Fortinet FortiSandbox
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RIESGO
abrir ↗GitHub PoC
1-day exploit for CVE-2026-49417
Multiple vulnerabilities in the sound(4) mmap path
41RIESGO
abrir ↗VulnCheck XDB
denial-of-service
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
83RIESGO
abrir ↗GitHub PoC
Reproduction lab for CVE-2025-29927 — Next.js middleware authorization bypass (CVSS 9.1)
Authorization Bypass in Next.js Middleware
85RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-35616
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta
100RIESGO
abrir ↗GitHub PoC
dotCMS Pre-auth SQL Injection
Unauthenticated SQL Injection in dotCMS Publish Audit API
63RIESGO
abrir ↗GitHub PoC★ 1
Caderno Temático NotebookLM: análise de vulnerabilidades SQL Injection (CVE-2024-42327, CVE-2026-23921) no Zabbix, com engenharia de prompts, cadeia de ataque até RCE e miniguia de hardening
SQL injection in user.get API
70RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2026-0257
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
100RIESGO
abrir ↗GitHub PoC
jenniferreire26/CVE-2024-21182
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
93RIESGO
abrir ↗GitHub PoC
fevar54/CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
93RIESGO
abrir ↗GitHub PoC
Patched google_gax 0.4.1 for Tesla 1.18.3+ compatibility (CVE-2026-48598)
CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
28RIESGO
abrir ↗GitHub PoC
CVE-2026-45067 - Draft
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
33RIESGO
abrir ↗GitHub PoC
CVE-2021-44228 漏洞复现完整记录（含环境搭建、触发验证）
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload
63RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-48907: Unauthenticated RCE in JCE (Proof Of Concept)
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RIESGO
abrir ↗GitHub PoC
CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 Unauthenticated PHP Object Injection -> Remote Code Execution
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
83RIESGO
abrir ↗VulnCheck XDB
initial-access
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
83RIESGO
abrir ↗GitHub PoC
kaiten cve
kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without t
48RIESGO
abrir ↗GitHub PoC
CVE-2024-52011 - Draft
launch-editor vulnerable to command injection via the crafted request on Windows
41RIESGO
abrir ↗GitHub PoC
CVE-2026-42271 - Draft
LiteLLM: Authenticated command execution via MCP stdio test endpoints
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.