Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.464 exploits
GitHub PoC
vintage-alt/CVE-2026-109618-and-CVE-2026-109619-php2shell-burpproxy
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 11
exploit php2shell (CVE-2026-109618 / CVE-2026-109619) for educational purposes
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
One-file PHP check for the PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619). No exploit, no network.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 4
Production-ready backported .patch for EOL PHP 5.4,.23 custom 5.x to fix the critical PHP2Shell (OOM) vulnerability (CVE-2026-109618 / CVE-2026-109619).
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
MOSTAFA JR7 - Custom security research framework targeting PHP 8.4.26 Apache Prefork RCE and ASLR bypass.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Quick Plex2Shell (CVE-2026-96652) exposure & version check — is your Plex Media Server patched (1.43.3.10861+)?
Plex Media Server SSRF
83RIESGO
abrir ↗GitHub PoC★ 1
Node2Shell / HTTP2Shell (CVE-2026-111497) exposure-audit kit — read-only scanner + agent prompt pack. Portable: macOS bash 3.2 + Linux. Mutation-tested regression suite, CI on 3 platforms.
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC★ 1
debjit604/PHP2Shell-CVE-2026-109618-CVE-2026-109619
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 2
Passive Node2Shell (CVE-2026-111497) exposure checker and offline Node.js runtime assessment with branded HTML reports. Python 3.10+, no dependencies, no exploit payloads.
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58041: SQLite cached iterator write replay. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to cont
33RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58045: zlib synchronous API spoofed TypedArray crash. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:z
33RIESGO
abrir ↗GitHub PoC
PHP2Shell(CVE-2026-109618/109619) 취약점 점검·대응 도구와 한국어 런북 (비공식, 방어용). Defensive check & response toolkit: Linux/Unix/Windows/containers, patch plans, virtual patches.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Offline Node.js evidence checker for CVE-2026-58044: HTTP header-limit request smuggling. Single-file Python; JSON/CSV/HTML reports; no exploit payloads.
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild ou
28RIESGO
abrir ↗GitHub PoC
A local test environment for PHP2Shell (CVE-2026-109618) on a vulnerable PHP server.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-102826: simple-git configuration include command injection. One exploit per repository; implementation pending.
simple-git allows command execution through unblocked Git configuration includes
41RIESGO
abrir ↗GitHub PoC
Offline vm2 evidence checker for CVE-2026-92935. Sandbox package and nesting evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
vm2 NodeVM Remote Code Execution via Array-Shaped Require
48RIESGO
abrir ↗GitHub PoC
100% Defensive Scanner for CVE-2026-110264 GitLab Arbitrary File Write (PHP2Shell) - No exploit code, only version & patch detection for security teams and learners.
Integer Overflow or Wraparound in GitLab
48RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-88778: Citrix NetScaler ADC / Gateway: Predictable TCP initial sequence numbers. One exploit per repository; implementation pending.
TCP Initial Sequence Number (ISN) prediction
41RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-88777: Citrix NetScaler ADC / Gateway: Non-HTTP L7 memory corruption. One exploit per repository; implementation pending.
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
41RIESGO
abrir ↗GitHub PoC
Offline Sharp / librsvg evidence checker for CVE-2026-96889. Sharp and librsvg version and build evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
Librsvg: use-after-free when xml includes have duplicated entities
41RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-88776: Citrix NetScaler ADC / Gateway: Oracle load-balancer memory corruption. One exploit per repository; implementation pending.
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
41RIESGO
abrir ↗GitHub PoC
Offline NetScaler ADC / Gateway evidence checker for CVE-2026-88771. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-104286: Fortinet FortiMail: Path traversal / NULL-byte arbitrary file write. One exploit per repository; implementation pending.
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-58043: Node.js: Permission Model path-prefix over-grant. One exploit per repository; implementation pending.
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
41RIESGO
abrir ↗GitHub PoC
Standalone defensive checker project for CVE-2026-56850: Node.js: HTTPS Agent PFX client identity collision. One exploit per repository; implementation pending.
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cli
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.