Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.402exploits catalogados

39.049CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.184Exploit-DB 24.485GitHub PoC 16.124VulnCheck XDB 9617Nuclei 4473Metasploit 3519✓ solo verificadosrecientes populares riesgo

16.077 exploits

GitHub PoC

Triage scanner for CVE-2025-55182 (React2Shell) and CVE-2025-66478. Local audit, remote fingerprint, log hunting. Detection only, no payloads.

CVE-2025-55182CRITICALbajo ataqueransomware08 oct 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

Vulhub nginx/CVE-2013-4547: Nginx Filename Logic Vulnerability (CVE-2013-4547), run with Isoloom

CVE-2013-4547—08 oct 2026

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap

35RIESGO

abrir ↗

GitHub PoC

Vulhub activemq/CVE-2016-3088: ActiveMQ Fileserver Arbitrary File Write (CVE-2016-3088), run with Isoloom

CVE-2016-3088CRITICALbajo ataque08 oct 2026

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitr

100RIESGO

abrir ↗

GitHub PoC

Vulhub coldfusion/CVE-2010-2861: Adobe ColdFusion 8 Directory Traversal (CVE-2010-2861), run with Isoloom

CVE-2010-2861HIGHbajo ataqueransomware08 oct 2026

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow re

100RIESGO

abrir ↗

GitHub PoC

Vulhub jenkins/CVE-2024-23897: Jenkins CLI Arbitrary File Read (CVE-2024-23897), run with Isoloom

CVE-2024-23897CRITICALbajo ataqueransomware08 oct 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RIESGO

abrir ↗

GitHub PoC

Vulhub php/CVE-2012-1823: PHP-CGI Query String Argument Injection (CVE-2012-1823), run with Isoloom

CVE-2012-1823CRITICALbajo ataque08 oct 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RIESGO

abrir ↗

GitHub PoC

Vulhub mysql/CVE-2012-2122: MySQL Authentication Bypass (CVE-2012-2122), run with Isoloom

CVE-2012-2122—08 oct 2026

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor

60RIESGO

abrir ↗

GitHub PoC

Triage scanner for CVE-2025-57819 (FreePBX Endpoint Manager unauthenticated SQLi to RCE). Detection only, no payloads.

CVE-2025-57819CRITICALbajo ataque08 oct 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RIESGO

abrir ↗

GitHub PoC

Vulhub cacti/CVE-2022-46169: Cacti remote_agent.php Command Injection (CVE-2022-46169), run with Isoloom

CVE-2022-46169CRITICALbajo ataque08 oct 2026

Unauthenticated Command Injection

100RIESGO

abrir ↗

GitHub PoC★ 1

Hands-on vulnerability analysis and non-destructive verification of the vsftpd 2.3.4 backdoor (CVE-2011-2523) in an isolated lab.

CVE-2011-2523—08 oct 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

abrir ↗

GitHub PoC

Vulhub imagemagick/CVE-2022-44268: ImageMagick PNG Text Chunk Arbitrary File Read (CVE-2022-44268), run with Isoloom

CVE-2022-44268MEDIUM08 oct 2026

ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulti

55RIESGO

abrir ↗

GitHub PoC

Laboratory proof of concept and research notes for CVE-2026-67279 on MikroTik RouterOS 6.42.

CVE-2026-67279MEDIUMbajo ataque08 oct 2026

SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

63RIESGO

abrir ↗

GitHub PoC

a challenge for a CVE-2026-49881

CVE-2026-49881HIGH08 oct 2026

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-91940: arbitrary file write in crawl4ai <=0.9.2 via the untrusted-config gate (PDFContentScrapingStrategy image_save_dir). Analysis, reproduction harness and verified 0.9.2 vs 0.9.3 boundary.

CVE-2026-91940HIGH08 oct 2026

crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy

41RIESGO

abrir ↗

GitHub PoC

Vulhub grafana/CVE-2021-43798: Grafana Plugin Path Traversal (CVE-2021-43798), run with Isoloom

CVE-2021-43798HIGHbajo ataque08 oct 2026

Grafana path traversal

100RIESGO

abrir ↗

GitHub PoC★ 1

Defensive security checker for Citrix NetScaler ADC & Gateway — CVE-2026-88771 through CVE-2026-88778

CVE-2026-88771CRITICALbajo ataque08 oct 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

78RIESGO

abrir ↗

GitHub PoC

Vulhub httpd/CVE-2021-42013: Apache HTTP Server 2.4.50 Path Traversal and RCE (CVE-2021-42013), run with Isoloom

CVE-2021-42013CRITICALbajo ataqueransomware08 oct 2026

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-92555 Exploit

CVE-2026-92555CRITICAL08 oct 2026

Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel

48RIESGO

abrir ↗

GitHub PoC

Vulhub webmin/CVE-2019-15107: Webmin password_change.cgi Pre-Auth RCE (CVE-2019-15107), run with Isoloom

CVE-2019-15107CRITICALbajo ataqueransomware08 oct 2026

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RIESGO

abrir ↗

GitHub PoC★ 8

CVE-2026-21589 detector for Atlassian Data Center webresource traversal. Pre-auth webroot file read confirm for Jira, Confluence and Bitbucket.

CVE-2026-21589CRITICAL07 oct 2026

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft

63RIESGO

abrir ↗

GitHub PoC

Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce

CVE-2026-102489HIGHbajo ataque07 oct 2026

Undisclosed RCE in Zammad v6.3 and higher

71RIESGO

abrir ↗

GitHub PoC★ 4

Independent PoC and reproducible lab for CVE-2026-97332 — User Private Files < 2.2.0 unauthenticated private file disclosure on WordPress Multisite.

CVE-2026-97332MEDIUM07 oct 2026

User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)

33RIESGO

abrir ↗

GitHub PoC

cve-2026-87902 lab

CVE-2026-87902HIGHbajo ataque07 oct 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-105844 — Payload CMS @payloadcms/plugin-import-export <3.88.0 unauth prototype pollution (CWE-1321, CVSS 4.0 9.3). PoCbit PoC: POST /api/exports/export-preview fields __proto__.overrideAccess → ACL bypass / data leak. check/exploit/mass. Fix 3.88.0+. https://pocbit.org/pocs/cve-2026-105844

CVE-2026-105844CRITICAL07 oct 2026

Payload: Prototype pollution in Payload Import Export plugin

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-102422 POC

CVE-2026-102422CRITICAL07 oct 2026

shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token

48RIESGO

abrir ↗

GitHub PoC

sungue1/CVE-2025-29927

CVE-2025-29927CRITICAL07 oct 2026

Authorization Bypass in Next.js Middleware

85RIESGO

abrir ↗

GitHub PoC★ 2

Smarty is vulnerable to code injection through template inheritance. Crafted assigned data can inject a forged SmartyNocache marker into regenerated PHP cache files, potentially allowing attackers to execute arbitrary PHP code. The issue affects Smarty 4.5.7 and earlier, and 5.8.4 and earlier.

CVE-2026-82531CRITICAL07 oct 2026

Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

48RIESGO

abrir ↗

GitHub PoC

Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN

CVE-2026-85102CRITICALbajo ataque07 oct 2026

Improper Certificate Validation in Quantum Security Gateway

78RIESGO

abrir ↗

GitHub PoC

DOS infinite-loop Vulnerability POC

CVE-2026-102253HIGH07 oct 2026

iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

41RIESGO

abrir ↗

GitHub PoC

Benign, offline reproduction of CVE-2026-93355 — LiteLLM unverified-email JWT account takeover (runs LiteLLM's real code)

CVE-2026-93355HIGH07 oct 2026

LiteLLM Weak JWT Authentication via Email-Based User Lookup

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.