Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.402exploits catalogados
39.049CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.184Exploit-DB 24.485GitHub PoC 16.124VulnCheck XDB 9617Nuclei 4473Metasploit 3519✓ solo verificadosrecientespopularesriesgo
16.124 exploits
GitHub PoC
a challenge for a CVE-2026-49881
In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the
41RIESGO
abrir ↗GitHub PoC
CVE-2026-91940: arbitrary file write in crawl4ai <=0.9.2 via the untrusted-config gate (PDFContentScrapingStrategy image_save_dir). Analysis, reproduction harness and verified 0.9.2 vs 0.9.3 boundary.
crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy
41RIESGO
abrir ↗GitHub PoC
Atlassian Data Center Multiple Products - Arbitrary File Access (Path Traversal)
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗GitHub PoC
CVE-2026-92555 Exploit
Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel
48RIESGO
abrir ↗GitHub PoC
Vulhub solr/CVE-2019-17558: Apache Solr Velocity Template RCE (CVE-2019-17558), run with Isoloom
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V
100RIESGO
abrir ↗GitHub PoC
Vulhub samba/CVE-2017-7494: SambaCry on Samba 4.6.3, run with Isoloom
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RIESGO
abrir ↗GitHub PoC
Vulhub jetty/CVE-2021-28164: Jetty Ambiguous Path Information Disclosure (CVE-2021-28164), run with Isoloom
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai
70RIESGO
abrir ↗GitHub PoC
Vulhub httpd/CVE-2021-42013: Apache HTTP Server 2.4.50 Path Traversal and RCE (CVE-2021-42013), run with Isoloom
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RIESGO
abrir ↗GitHub PoC
Vulhub grafana/CVE-2021-43798: Grafana Plugin Path Traversal (CVE-2021-43798), run with Isoloom
Grafana path traversal
100RIESGO
abrir ↗GitHub PoC
Vulhub nginx/CVE-2013-4547: Nginx Filename Logic Vulnerability (CVE-2013-4547), run with Isoloom
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
35RIESGO
abrir ↗GitHub PoC
Vulhub couchdb/CVE-2017-12635: Apache CouchDB Privilege Escalation (CVE-2017-12635), run with Isoloom
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be
60RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-21589 — Atlassian DC pre-auth arbitrary file read (CVSS 4.0 9.3). PoCbit PoC: atlassian-plugins-webresource ..:: traversal on /download/resources/ for Jira, Confluence, Bitbucket. check + exploit (WEB-INF/web.xml, crowd.properties). Batch JSONL, hits.txt. Not RCE. https://pocbit.org/pocs/cve-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗GitHub PoC
Vulhub drupal/CVE-2018-7600: Drupalgeddon 2 on Drupal 8.5.0, run with Isoloom
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RIESGO
abrir ↗GitHub PoC
Vulhub openssl/CVE-2014-0160: Heartbleed on nginx with OpenSSL 1.0.1c, run with Isoloom
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RIESGO
abrir ↗GitHub PoC★ 1
Hands-on vulnerability analysis and non-destructive verification of the vsftpd 2.3.4 backdoor (CVE-2011-2523) in an isolated lab.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗GitHub PoC
Detection PoC for CVE-2026-5430 — unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0–4.6.0. Read-only assessment tool with patch confirmation and WAF detection. Authorized use only.
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
78RIESGO
abrir ↗GitHub PoC
Уязвимая лаборатория WSO2 API Manager 4.5.0 в Docker, сканер и эксплойт для CVE-2026-5430 (обход аутентификации через поддельный HS256 JWT)
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
78RIESGO
abrir ↗GitHub PoC
Vulhub php/CVE-2019-11043: PHP-FPM 7.2.10 PATH_INFO underflow RCE, run with Isoloom
Underflow in PHP-FPM can lead to RCE
100RIESGO
abrir ↗GitHub PoC
theendofabbys/CVE-2026-61424
Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2
48RIESGO
abrir ↗GitHub PoC
Vulhub supervisor/CVE-2017-11610: Supervisord XML-RPC RCE (CVE-2017-11610), run with Isoloom
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows rem
60RIESGO
abrir ↗GitHub PoC
Vulhub joomla/CVE-2023-23752: Joomla Webservice Improper Access Check (CVE-2023-23752), run with Isoloom
[20230201] - Core - Improper access check in webservice endpoints
100RIESGO
abrir ↗GitHub PoC
Triage scanner for CVE-2025-57819 (FreePBX Endpoint Manager unauthenticated SQLi to RCE). Detection only, no payloads.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗GitHub PoC
Vulhub gitlab/CVE-2021-22205: GitLab CE 13.10.1 ExifTool unauthenticated RCE, run with Isoloom
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati
100RIESGO
abrir ↗GitHub PoC
Vulhub jenkins/CVE-2024-23897: Jenkins CLI Arbitrary File Read (CVE-2024-23897), run with Isoloom
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RIESGO
abrir ↗GitHub PoC
Triage scanner for CVE-2025-55182 (React2Shell) and CVE-2025-66478. Local audit, remote fingerprint, log hunting. Detection only, no payloads.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
Vulhub spring/CVE-2022-22947: Spring Cloud Gateway Actuator Code Injection (CVE-2022-22947), run with Isoloom
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RIESGO
abrir ↗GitHub PoC
Vulhub shiro/CVE-2016-4437: Shiro 1.2.4 rememberMe deserialization, run with Isoloom
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack
100RIESGO
abrir ↗GitHub PoC
a proof of concept for the apache log4j Java logging library (CVE-2021-44228 vulnerability)
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
Vulhub coldfusion/CVE-2010-2861: Adobe ColdFusion 8 Directory Traversal (CVE-2010-2861), run with Isoloom
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow re
100RIESGO
abrir ↗GitHub PoC
Vulhub spring/CVE-2022-22963: Spring Cloud Function SpEL Injection (CVE-2022-22963), run with Isoloom
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.