Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.464 exploits
GitHub PoC
Browser-based terminal-style UI for assetnote's php2shell-scanner (CVE-2026-109618 / CVE-2026-109619), with live per-probe SSE activity log and JSON export. Detection engine by assetnote; original discovery by Calif.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
Unauthenticated RCE in PHP via session.upload_progress use-after-free (CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 11
CVE-2026-98260 一键 root | 玄戒 O1 家族：Xiaomi Pad 7S Pro 12.5 (violin) / Pad 7 Ultra (jinghu) / 15S Pro (dijun)，内核 6.18.21 | 可选加载 KernelSU / SukiSU / KernelSU Next / 7kimisu
exec: Cleanup POSIX timers right after de_thread()
41RIESGO
abrir ↗GitHub PoC
PHP2Shell — Unauthenticated RCE chain exploiting CVE-2026-109618 (OOM memory corruption) + CVE-2026-109619 (stale global state) in PHP.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Controlled lab pinned to PHP 8.3.35 for reproducing/patch-verifying PHP2Shell (CVE-2026-109618, CVE-2026-109619)
RCE via OOM corruption
100RIESGO
abrir ↗VulnCheck XDB
initial-access
TVT NVMS-9000 Hard-coded API Credentials & Command Injection
48RIESGO
abrir ↗GitHub PoC★ 2
Pre-auth RCE against WordPress (7.1.2/7.1.3) via PHP2Shell CVE-2026-109618 / CVE-2026-109619
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Unofficial CentOS 7 (EL7) rebuild of Remi php-8.1.34-6 with the PHP2Shell (CVE-2026-109618, CVE-2026-109619) mitigation
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-109618 / 109619 research & exploit tooling (mod_php + FPM Chain-E)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Offline Python detector for CVE-2026-91403 certificate indicators in Java trust stores, with fingerprint matching and JSON reports.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE
48RIESGO
abrir ↗GitHub PoC
CVE-2026-90931: LaraDashboard stored XSS via SVG upload — bilingual analysis and safe PoC
LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
33RIESGO
abrir ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RIESGO
abrir ↗VulnCheck XDB
initial-access
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
100RIESGO
abrir ↗VulnCheck XDB
initial-access
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RIESGO
abrir ↗VulnCheck XDB
info-leak
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave
60RIESGO
abrir ↗VulnCheck XDB
info-leak
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REG
50RIESGO
abrir ↗VulnCheck XDB
initial-access
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
53RIESGO
abrir ↗GitHub PoC★ 1
Audit & Vulnerability Detection Scanner for PHP2Shell (CVE-2026-109618 & CVE-2026-109619) with Hardening Guidelines
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
Universal scanner and automated patching playbook for CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell")
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
CVE-2026-75650 (StyleSmuggler): unauthenticated RCE via template injection in Magento Open Source / Adobe Commerce 2.4.4–2.4.9 — b63 showcase, lab-verified with patched-build negative test
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in ou
35RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-90932: LaraDashboard path traversal to arbitrary file deletion/write — bilingual analysis and safe PoC
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
41RIESGO
abrir ↗GitHub PoC
Benign client-testing detector for PHP2Shell / PHP session upload-progress (CVE-2026-109618, CVE-2026-109619): version ladder, config gate, behavioral probe, and the chain pubstate probe. Stdlib-only; Linux, macOS, Windows.
RCE via OOM corruption
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.