Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
71.114exploits catalogados
31.649CVEs con explotación pública
0probados en laboratorio
TodosExploit-DB 22.469Referência 19.810GitHub PoC 13.116VulnCheck XDB 8069Nuclei 4188Metasploit 3462✓ solo verificadosrecientespopularesriesgo
13.116 exploits
GitHub PoC
Langflow remote code execution exploit
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
68RIESGO
abrir ↗GitHub PoC
felisha-elmer/Sandbox-Challenge-Log4Shell-CVE-2021-44228-
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
CVE-2026-0926 exploit. The Prodigy Commerce plugin for WordPress Local File Inclusion
Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]
63RIESGO
abrir ↗GitHub PoC
mein-0/cve-2025-7771
Code Execution / Escalation of Privileges in ThrottleStop
41RIESGO
abrir ↗GitHub PoC
Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload
Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload
48RIESGO
abrir ↗GitHub PoC★ 8
R3n3r0/CVE-2026-20700
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3,
71RIESGO
abrir ↗GitHub PoC
Private exploit
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RIESGO
abrir ↗GitHub PoC
Google Dorks for detecting CMS Made Simple < 2.2.10 SQL Injection (CVE-2019-9053). Built for security auditing and patch verification.
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RIESGO
abrir ↗GitHub PoC
Ethical Hacking Assessment | Practical vulnerability testing of vsftpd 2.3.4 backdoor (CVE-2011-2523) on Metasploitable2 using Kali Linux & Metasploit
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗GitHub PoC★ 1
CVE-2018-13379 mass exploiter for Fortinet FortiOS SSL VPN. Extracts credentials instantly, saves to CSV + PostgreSQL. Multi-threaded, no bullshit warnings.
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.
100RIESGO
abrir ↗GitHub PoC
CVE-2026-6960: BookingPress Pro <= 5.6 – Unauthenticated Arbitrary File Upload
BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field
48RIESGO
abrir ↗GitHub PoC★ 1
renewablehacking/CVE-2025-55182-React-19.2.0
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
CVE-2026-6279: Avada (Fusion) Builder <= 3.15.2 – Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler (fusion-builder)
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
48RIESGO
abrir ↗GitHub PoC
Xmyronn/CVE-2026-11518-XSS
SourceCodester Inventory System User Management users.php cross site scripting
33RIESGO
abrir ↗GitHub PoC★ 1
Unauthenticated Privilege Escalation CVE-2026-9018: Easy Elements for Elementor
Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-48172
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i
83RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-6279 — Avada Builder <= 3.15.2 Unauthenticated RCE via call_user_func()
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
48RIESGO
abrir ↗GitHub PoC
cPanel user run arbitrary scripts as root
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i
83RIESGO
abrir ↗GitHub PoC
webdev75950-ux/nginx-rce-cve-2026-42945
NGINX ngx_http_rewrite_module vulnerability
60RIESGO
abrir ↗GitHub PoC
Divi Form Builder <= 5.1.2 — Unauthenticated Privilege Escalation via Role Injection
Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'
48RIESGO
abrir ↗GitHub PoC
CVE-2026-34926
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker t
68RIESGO
abrir ↗GitHub PoC
NullByte8080/CVE-2026-36228
Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execu
41RIESGO
abrir ↗GitHub PoC
NullByte8080/CVE-2026-36227
Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and e
33RIESGO
abrir ↗GitHub PoC
NullByte8080/CVE-2026-36226
Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensit
33RIESGO
abrir ↗GitHub PoC★ 1
PoC for CVE-2026-42945 (nginx Rift) — heap buffer overflow in ngx_http_rewrite_module. Includes detect/probe/exploit modes, dual-fixture Docker lab, empirical address discovery, OOB-verified offset sweep. Original disclosure by depthfirst.
NGINX ngx_http_rewrite_module vulnerability
60RIESGO
abrir ↗GitHub PoC
A Go implementation of PinTheft (CVE-2026-43494)
net/rds: reset op_nents when zerocopy page pin fails
41RIESGO
abrir ↗GitHub PoC
CVE-2026-42208 - LiteLLM SQL Injection vulnerability scanner for BerriAI LiteLLM proxy instances
LiteLLM: SQL injection in Proxy API key verification
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.