Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.651exploits catalogados
39.246CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.347Exploit-DB 24.485GitHub PoC 16.174VulnCheck XDB 9644Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
16.174 exploits
GitHub PoC
Drupalgeddon2 CVE-2018-7600 vulnerable Drupal 7 lab
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RIESGO
abrir ↗GitHub PoC
Balboa form Command Injection POC
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2
41RIESGO
abrir ↗GitHub PoC
Safe passive detector for identifying WPMU DEV Dashboard versions affected by CVE-2026-76581.
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
48RIESGO
abrir ↗GitHub PoC★ 4
CBDC Infrastructure Vulnerability Research. CVE-2026-78904: Infinite mint and redemption bypass in central bank digital currency APIs.
Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitra
28RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-80724 PoC + full write-up — Linux kernel ptp/vmclock read-only mapping becomes writable (VM_MAYWRITE). Discovered, reported & fixed by Abdifatah Suruur (suruurism)
ptp: vmclock: prevent read-only mappings from becoming writable
41RIESGO
abrir ↗GitHub PoC
CVE-2026-76581
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
48RIESGO
abrir ↗GitHub PoC★ 1
Public PoC for CVE-2026-82222
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RIESGO
abrir ↗GitHub PoC
🫖 Direct single-target Gitea CVE-2026-60004 RCE validation PoC
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RIESGO
abrir ↗GitHub PoC
CVE-2026-12513 Vulnerability Advisory & PoC — Discovered by Huynh Kien Minh (MinhHK).
Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal
33RIESGO
abrir ↗GitHub PoC
🫖 Contract-correlated discovery and authorized validation tool for Gitea CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RIESGO
abrir ↗GitHub PoC★ 1
PoC CVE-2026-18741
Worksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description Fields
33RIESGO
abrir ↗GitHub PoC
CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing.
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
71RIESGO
abrir ↗GitHub PoC★ 1
FastGPT Community Edition NoSQL Injection PoC (CVE-2026-79483)
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistor
33RIESGO
abrir ↗GitHub PoC
Automated PoC for CVE-2026-48611 — phpBB OAuth login_link authentication bypass
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or
63RIESGO
abrir ↗GitHub PoC
Read-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 / CVE-2026-60137)
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗GitHub PoC
CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing.
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RIESGO
abrir ↗GitHub PoC
CVE-2026-45833 ChromaDB
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacke
48RIESGO
abrir ↗GitHub PoC★ 16
Authorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix.
WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
63RIESGO
abrir ↗GitHub PoC
SOC investigation of a CVE-2024-49138 exploitation alert using log analysis, threat intelligence, and endpoint containment.
Windows Common Log File System Driver Elevation of Privilege Vulnerability
76RIESGO
abrir ↗GitHub PoC
Authorized penetration test against Metasploitable2 and TryHackMe Blue. 3 CVEs exploited (CVE-2011-2523, CVE-2007-2447, CVE-2017-0144), 4 findings with CVSS scoring and MITRE ATT&CK mapping.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗GitHub PoC
CVE-2026-47884:覆盖 15 条 Spring / Tomcat 官方安全公告,8 条被 NVD 报成 CRITICAL 9.x 而厂商官方评 LOW/MEDIUM,另 7 条两边一致 —— 差别只在厂商有没有自己提交 CVSS。工具告诉你中了哪几条、官方评多少分、是否真满足触发条件,以及官方叫你升的版本 Maven Central 上有没有。
Spring Framework Improper Path Limitation in XsltView
48RIESGO
abrir ↗GitHub PoC
joaovicdev/EXPLOIT-CVE-2026-9198
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RIESGO
abrir ↗GitHub PoC
FranklinF25/cve-2026-42533
NGINX Map directive and Regex matching vulnerability
48RIESGO
abrir ↗GitHub PoC
Static XML fixtures for authorized bug bounty testing of XML parser behaviour (CVE-2026-45071).
Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
41RIESGO
abrir ↗GitHub PoC
Authorized penetration test against Metasploitable2 and TryHackMe Blue. 3 CVEs exploited (CVE-2011-2523, CVE-2007-2447, CVE-2017-0144), 4 findings with CVSS scoring and MITRE ATT&CK mapping.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗GitHub PoC★ 3
Proof of concept exploit code for CVE-2026-19286
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
48RIESGO
abrir ↗GitHub PoC★ 1
Proof of concept exploit code for CVE-2026-18729
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
56RIESGO
abrir ↗GitHub PoC
Hunt-Benito/your-bot-my-inbox-cve-2026-68929-fastgpt-unauthenticated-wechat-channel-hijack
FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization
48RIESGO
abrir ↗GitHub PoC★ 2
#PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit 2 3 A **defensive** toolkit to check and understand exposure to the chained
PaperCut MF/NG: Authentication Bypass
100RIESGO
abrir ↗GitHub PoC★ 4
Security research tool for PaperCut CVE-2026-81578 & CVE-2026-82078
PaperCut MF/NG: Authentication Bypass
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.