Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.554exploits catalogados
39.165CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientespopularesriesgo
16.153 exploits
GitHub PoC★ 4
POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
48RIESGO
abrir ↗GitHub PoC
Standalone proof of concept for CVE-2026-86547, a NULL pointer dereference in mrubyc op_enter() through 4.0.0.
mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER
33RIESGO
abrir ↗GitHub PoC
Defensive IOC and detection toolkit for CVE-2026-86218, a critical pre-auth RCE in N-able N-central. Includes IOCs, log scanner, Sigma, Splunk, Elastic/KQL detections, and incident response guidance.
pre-authentication remote code execution
98RIESGO
abrir ↗GitHub PoC
In the miniOrange 2FA WordPress plugin (versions before 6.3.1 and 19.3), the two-factor authentication (2FA) attempt limit is flawed.
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout
41RIESGO
abrir ↗GitHub PoC
Apache Tomcat CVE-2025-24813 本地复现、利用条件分析与 AI 辅助验证记录
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗GitHub PoC
Comprehensive multi-layer defense system against Adobe Flash CVE exploits (CVE-2012-0754, CVE-2015-xxxx, CVE-2016-xxxx, CVE-2018-xxxx) with browser, mobile, server, and system-level protection
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.
100RIESGO
abrir ↗GitHub PoC
PoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
CVE-2026-15667 WordPress Event Solution LFI POC
Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
21RIESGO
abrir ↗GitHub PoC
Simple Proof Of Concept about CVE 2026-33017
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
98RIESGO
abrir ↗GitHub PoC
Write-up and proof of concept for CVE-2026-20516: MediaTek Android TV MiracastService confused deputy vulnerability.
In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denia
33RIESGO
abrir ↗GitHub PoC★ 88
🛡️ Official AI Security Tool module for CVE-2026-54121 (Certighost - AD CS Domain Controller Impersonation & PKINIT Elevation).
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC
SecDim Challenge Builder repro inspired by CVE-2026-88861: AAL1 MFA bypass at privileged credential boundary
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
41RIESGO
abrir ↗GitHub PoC
Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery
WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability
41RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-85706_docker_exp
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC★ 43
Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC★ 6
CVE-2026-89013 Exploit — Authorization bypass in Dolibarr via the hashp parameter, enabling unauthenticated access to protected documents and files.
Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
56RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-51990 - Draft or TODO
An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary
48RIESGO
abrir ↗GitHub PoC
PoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
Drag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.🔥
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
48RIESGO
abrir ↗GitHub PoC
Hunt-Benito/the-callback-that-outlived-the-page-cve-2026-78997-uc-browser-android-universal-xss
UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulner
48RIESGO
abrir ↗GitHub PoC
OpenPanel Unauthenticated Server-Side Request Forgery (SSRF)
OpenPanel before 2.3.0 SSRF via favicon and og endpoints
21RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-18351 — Drag and Drop File Upload for Elementor Forms <= 1.6.0 Unauthenticated Arbitrary File Upload -> RCE
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
48RIESGO
abrir ↗GitHub PoC★ 6
CVE-2026-89012 Exploit — SQL filter denylist bypass in Dolibarr via case-insensitive SQL column resolution and case-sensitive denylist matching.
Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter
41RIESGO
abrir ↗GitHub PoC
Marimo WS Preauth RCE
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RIESGO
abrir ↗GitHub PoC
Easy Media Replace <= 0.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title
33RIESGO
abrir ↗GitHub PoC★ 1
CVE-2004-2687 (Distcc 3.2.1) exploitation, methodology & remediation — Metasploitable2 lab
distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote at
60RIESGO
abrir ↗GitHub PoC
CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory.
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbi
33RIESGO
abrir ↗GitHub PoC★ 9
CVE-2026-85706 Unauthenticated File Read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗GitHub PoC
Sanitized offline fixture verifier for CVE-2026-81861 in SCADAPack Secure Lock
CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information
33RIESGO
abrir ↗GitHub PoC
Writeup: Hackcar - DockerLabs (Node.js Inspector RCE + CVE-2025-55182 React2Shell)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.