Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.554exploits catalogados

39.165CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.153 exploits

GitHub PoC

End-to-end recon and exploitation of a known backdoor (CVE-2010-2075) on Metasploitable2 using Nmap and Metasploit.

CVE-2010-2075—11 sep 2026

UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally

60RIESGO

abrir ↗

GitHub PoC

Drag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.🔥

CVE-2026-18351CRITICAL11 sep 2026

Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter

48RIESGO

abrir ↗

GitHub PoC

Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery

CVE-2026-65540HIGH11 sep 2026

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

41RIESGO

abrir ↗

GitHub PoC

Wordpress Plugin ELEX WooCommerce Request a Quote unauthenticated SQL injection POC

CVE-2026-14962HIGH11 sep 2026

ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id

41RIESGO

abrir ↗

GitHub PoC★ 6

CVE-2026-89012 Exploit — SQL filter denylist bypass in Dolibarr via case-insensitive SQL column resolution and case-sensitive denylist matching.

CVE-2026-89012HIGH11 sep 2026

Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

41RIESGO

abrir ↗

GitHub PoC★ 5

SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter

CVE-2026-87491HIGHbajo ataque10 sep 2026

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code in

71RIESGO

abrir ↗

GitHub PoC★ 1

hakaioffsec/CVE-2026-63642

CVE-2026-63642MEDIUM10 sep 2026

MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

33RIESGO

abrir ↗

GitHub PoC

Saku0512/CVE-2026-72815-poc

CVE-2026-72815MEDIUM10 sep 2026

go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

33RIESGO

abrir ↗

GitHub PoC

CVE-2016-3223 - Draft or TODO

CVE-2016-3223—10 sep 2026

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an

28RIESGO

abrir ↗

GitHub PoC

ivanesk315/CVE-2026-18963

CVE-2026-18963CRITICAL10 sep 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

abrir ↗

GitHub PoC

ivanesk315/CVE-2026-13181-Telerik

CVE-2026-13181HIGH10 sep 2026

RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

41RIESGO

abrir ↗

GitHub PoC

The MariaDB 13.1.0 RCE LAB is a testing environment designed to validate an exploit chain that combines an OOB Read vulnerability in the share->field pointer array with multiple additional vulnerabilities, ultimately achieving arbitrary code execution with mysql privileges.

CVE-2026-107821HIGH10 sep 2026

MariaDB: insufficient validation of binary frm data when opening a table

41RIESGO

abrir ↗

GitHub PoC★ 1

Conducted a complete security assessment of an unpatched Windows 7 target ("Blue") to demonstrate the impact of legacy service vulnerabilities in an enterprise environment

CVE-2017-0144HIGHbajo ataqueransomware10 sep 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

GitHub PoC★ 1

Mikrotik CVE-2026-86060 Score 9.2 Critical

CVE-2026-86060CRITICALbajo ataque10 sep 2026

SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

78RIESGO

abrir ↗

GitHub PoC

vudangducminh/CVE-2022-0847

CVE-2022-0847HIGHbajo ataque10 sep 2026

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RIESGO

abrir ↗

GitHub PoC

ivanesk315/CVE-2026-66066

CVE-2026-66066CRITICAL10 sep 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

68RIESGO

abrir ↗

GitHub PoC

ivanesk315/CVE-2026-42533

CVE-2026-42533CRITICAL10 sep 2026

NGINX Map directive and Regex matching vulnerability

48RIESGO

abrir ↗

GitHub PoC

hainhc/CVE-2026-73570

CVE-2026-73570HIGHbajo ataque10 sep 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

100RIESGO

abrir ↗

GitHub PoC

PrinceAikinsBaidoo/CVE-2022-24637

CVE-2022-24637—10 sep 2026

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh

60RIESGO

abrir ↗

GitHub PoC

Might be used to share PoC and findings regarding CVE-2026-73786 in the future

CVE-2026-73786HIGH10 sep 2026

Unauthenticated Network-Based Denial of Service in CPPM systems

41RIESGO

abrir ↗

GitHub PoC

Jasper2018/CVE-2018-20062

CVE-2018-20062CRITICALbajo ataque10 sep 2026

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP

100RIESGO

abrir ↗

GitHub PoC

ethicbrudhack/CVE-2008-0166-BTC-satoshi-mining-wallets

CVE-2008-0166—10 sep 2026

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge

45RIESGO

abrir ↗

GitHub PoC

ivanesk315/CVE-2026-60137-and-CVE-2026-63030

CVE-2026-60137MEDIUMbajo ataque10 sep 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RIESGO

abrir ↗

GitHub PoC

ivanesk315/CVE-2026-28496

CVE-2026-28496CRITICAL10 sep 2026

FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

63RIESGO

abrir ↗

GitHub PoC

Walkthrough, threat analysis, and remediation guide for CVE-2017-0144 (EternalBlue).

CVE-2017-0144HIGHbajo ataqueransomware10 sep 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

GitHub PoC

Checkov PoC: arbitrary code execution through auto-loaded configuration and unsigned external Python checks.

CVE-2026-0303LOW10 sep 2026

Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File

28RIESGO

abrir ↗

GitHub PoC

ZeroDayVPN/CVE-2026-83991-WriteUP-and-PoC

CVE-2026-83991MEDIUM10 sep 2026

Windows Cloud Files Mini Filter Driver Tampering Vulnerability

33RIESGO

abrir ↗

GitHub PoC★ 1

Safely detect Citrix NetScaler SAML auth bypass CVE-2026-19490

CVE-2026-19490CRITICALbajo ataque10 sep 2026

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

83RIESGO

abrir ↗

GitHub PoC

BrainBob/CVE-2026-76578

CVE-2026-76578CRITICAL09 sep 2026

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

48RIESGO

abrir ↗

GitHub PoC★ 3

SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress; SMS Alert <3.9.6; Unauthenticated Privilege Escalation (Forced Password Reset)

CVE-2026-11387CRITICAL09 sep 2026

SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

63RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.