Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.655exploits catalogados

39.248CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.347Exploit-DB 24.485GitHub PoC 16.178VulnCheck XDB 9644Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.178 exploits

GitHub PoC

Authorized penetration test against Metasploitable2 and TryHackMe Blue. 3 CVEs exploited (CVE-2011-2523, CVE-2007-2447, CVE-2017-0144), 4 findings with CVSS scoring and MITRE ATT&CK mapping.

CVE-2011-2523—29 ago 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

GitHub PoC★ 3

Proof of concept exploit code for CVE-2026-19286

CVE-2026-19286CRITICAL29 ago 2026

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

48RIESGO

GitHub PoC★ 2

Learn how I found my first two CVEs by pure accident.

CVE-2026-19745MEDIUM29 ago 2026

Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service

33RIESGO

GitHub PoC

Hunt-Benito/your-bot-my-inbox-cve-2026-68929-fastgpt-unauthenticated-wechat-channel-hijack

CVE-2026-68929CRITICAL29 ago 2026

FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

48RIESGO

GitHub PoC

Authorized penetration test against Metasploitable2 and TryHackMe Blue. 3 CVEs exploited (CVE-2011-2523, CVE-2007-2447, CVE-2017-0144), 4 findings with CVSS scoring and MITRE ATT&CK mapping.

CVE-2017-0144HIGHbajo ataqueransomware29 ago 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

GitHub PoC★ 2

#PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit 2 3 A **defensive** toolkit to check and understand exposure to the chained

CVE-2026-81578HIGHbajo ataque29 ago 2026

PaperCut MF/NG: Authentication Bypass

100RIESGO

GitHub PoC

CVE-2026-82286 — gpt-crawler <=1.5.1 unauthenticated arbitrary file write via outputFileName (POST /crawl). PoC + self-contained Docker lab. CVSS 8.6, CWE-22.

CVE-2026-82286HIGH29 ago 2026

gpt-crawler Arbitrary File Write via outputFileName Parameter

41RIESGO

GitHub PoC★ 4

Security research tool for PaperCut CVE-2026-81578 & CVE-2026-82078

CVE-2026-81578HIGHbajo ataque29 ago 2026

PaperCut MF/NG: Authentication Bypass

100RIESGO

GitHub PoC

Jenkins CVE-2024-23897 — CSRF-crumb aware PoC

CVE-2024-23897CRITICALbajo ataqueransomware28 ago 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RIESGO

GitHub PoC★ 1

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit

CVE-2026-33017CRITICALbajo ataque28 ago 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

98RIESGO

GitHub PoC

CVE-2026-33017 PoC Reverse Shell

CVE-2026-33017CRITICALbajo ataque28 ago 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

98RIESGO

GitHub PoC

Cacti 1.2.22 unauthenticated command injection

CVE-2022-46169CRITICALbajo ataque28 ago 2026

Unauthenticated Command Injection

100RIESGO

GitHub PoC

I know you are probably here from Hack the Box, if so, yes this one actually works.

CVE-2025-55182CRITICALbajo ataqueransomware28 ago 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

CVE-2026-65643 - Draft or TODO

CVE-2026-65643HIGH28 ago 2026

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

41RIESGO

GitHub PoC★ 1

Proof of concept exploit code for CVE-2026-19295

CVE-2026-19295CRITICAL28 ago 2026

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

63RIESGO

GitHub PoC

Testing CVE-2026-70463 by Fyyre

CVE-2026-70463HIGH28 ago 2026

rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

41RIESGO

GitHub PoC

CVE-2026-66384 - Draft or TODO

CVE-2026-66384MEDIUMbajo ataque28 ago 2026

Authenticated users may write data outside the intended Docker cache path

63RIESGO

GitHub PoC

IKEv1 VPN scanners, attempts a Check Point authentication-bypass exploit, and includes internal network scanning and reverse-shell features.

CVE-2026-50751CRITICALbajo ataqueransomware28 ago 2026

User Authentication Bypass in VPN Remote Access and Mobile Access

100RIESGO

GitHub PoC★ 3

hideki233/CVE-2025-3248-Langflow-RCE

CVE-2025-3248CRITICALbajo ataqueransomware28 ago 2026

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RIESGO

GitHub PoC

Wazuh Rules for Detection Zimbra (CVE-2026-73570).

CVE-2026-73570HIGHbajo ataque28 ago 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

100RIESGO

GitHub PoC

Hari-v542/CVE-2026-52923

CVE-2026-52923HIGH28 ago 2026

ipc: limit next_id allocation to the valid ID range

41RIESGO

GitHub PoC

CVE-2023-27350, CVE-2023-27351 - PaperCut - Draft or TODO

CVE-2023-27350CRITICALbajo ataqueransomware28 ago 2026

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui

100RIESGO

GitHub PoC★ 1

poc and yara rules

CVE-2025-59528CRITICAL28 ago 2026

Flowise has Remote Code Execution vulnerability

85RIESGO

GitHub PoC

A PoC exploit for CVE-2026-24061 - GNU InetUtils telnetd Argument Injection Authentication Bypass

CVE-2026-24061CRITICALbajo ataque28 ago 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

A specialized Python framework that executes unauthenticated remote code execution via the 9Router Model Context Protocol (MCP) bridge by deploying a 33-layer temporal phase cascade, Riemann-Hadamard dispersion, and an 11 ns wedge filter to bypass traditional proxy and process-monitoring defenses.

CVE-2026-46339CRITICAL28 ago 2026

9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

63RIESGO

GitHub PoC

fastjson-cve-2026-16723

CVE-2026-16723CRITICAL28 ago 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

GitHub PoC

Hack The Box Nexus machine write-up covering reconnaissance, Gitea credential discovery, Krayin CRM exploitation via CVE-2026-38526, initial access, and privilege escalation through a vulnerable Gitea template synchronization service.

CVE-2026-38526CRITICAL27 ago 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC

CVE-2026-77542, CVE-2026-77543, CVE-2026-77545, CVE-2026-77550, CVE-2026-77551, CVE-2026-77552, CVE-2026-77553, CVE-2026-77554, CVE-2026-77557 - Draft or TODO

CVE-2026-77542CRITICAL27 ago 2026

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit

48RIESGO

GitHub PoC★ 1

sahmsec/CVE-2026-32475

CVE-2026-32475CRITICAL27 ago 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RIESGO

GitHub PoC

A scanner for CVE-2026-55040 and CVE-2026-63520, designed to determine whether the server is affected by these two CVEs.

CVE-2026-55040CRITICALbajo ataque27 ago 2026

Microsoft SharePoint Server Security Feature Bypass Vulnerability

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.