Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.713exploits catalogados
39.298CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
16.200 exploits
GitHub PoC
George0Papasotiriou/CVE-2026-11116-SNMPv3-Authentication-Bypass-via-Default-EngineID
Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code
41RIESGO
abrir ↗GitHub PoC
George0Papasotiriou/CVE-2026-11117-WPA2-4-Way-Handshake-Reinstallation-KRACK-Sim-
Use after free in Views in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrar
41RIESGO
abrir ↗GitHub PoC
0xdak/CVE-2025-32463_exploit
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RIESGO
abrir ↗GitHub PoC
webshellseo8/CVE-2026-12720-Proof-of-Concept
Kirki < 6.0.13 - Unauthenticated PHP Object Injection
41RIESGO
abrir ↗GitHub PoC
George0Papasotiriou/CVE-2026-11115-Database-Connection-String-Injection-via-Env-Variable
Use after free in Updater in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-leve
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-66066 — KindaRails2Shell: Rails Active Storage/libvips Arbitrary File Read → RCE. MATLAB/HDF5 dual-identity file → SECRET_KEY_BASE theft → forged variation. CVSS 9.5 | Rails < 8.1.3.1
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
68RIESGO
abrir ↗GitHub PoC
Safe PowerShell validator for PHP CVE-2026-17543 exposure via HTTP headers and non-destructive login-form probes.
SQL injection in ext-pgsql via E'...' backslash breakout
41RIESGO
abrir ↗GitHub PoC
Shams-Ul-Mehmood/CVE-2021-41773-Exploit
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗GitHub PoC
George0Papasotiriou/CVE-2026-11108-Integer-Overflow-in-Memory-Allocator-kmalloc-Sim-
Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perf
41RIESGO
abrir ↗GitHub PoC
Foxer131/CVE-2026-70481
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
33RIESGO
abrir ↗GitHub PoC
CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RIESGO
abrir ↗GitHub PoC
x-znn/CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗GitHub PoC★ 2
CVE-2026-63223 — CI4RCE: CodeIgniter 4 is_image/mime_in File Upload RCE. Magic bytes bypass (getExtension vs getClientExtension). CVSS 9.8 | CWE-434 | CI4 < 4.7.4
CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
48RIESGO
abrir ↗GitHub PoC
George0Papasotiriou/CVE-2026-11113-SMTP-Header-Injection-in-Contact-Form
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker wh
48RIESGO
abrir ↗GitHub PoC
CVE-2026-45033 PoC for Claude Code, not Github Copilot. Worked for Haiku 4.5.
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
41RIESGO
abrir ↗GitHub PoC
🚨 Threat intel & incident response research on SharePoint "ToolShell" RCE zero-day (CVE-2025-53770). 🕵️♂️ Covers root-cause deserialization flaws, attack timelines, risk metrics, and defensive EDR validation playbooks. 🛡️
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RIESGO
abrir ↗GitHub PoC
0xdak/CVE-2026-59243_exploit
Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)
48RIESGO
abrir ↗GitHub PoC
George0Papasotiriou/CVE-2026-21016-Malicious-PyPI-Package-Install-Hook-setup.py-Execution-
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensi
33RIESGO
abrir ↗GitHub PoC
George0Papasotiriou/CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read
Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique id
33RIESGO
abrir ↗GitHub PoC
0xdak/CVE-2026-67340_exploit
ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts
41RIESGO
abrir ↗GitHub PoC
George0Papasotiriou/CVE-2026-21017-LDAP-Anonymous-Bind-Privilege-Escalation
Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attack
33RIESGO
abrir ↗GitHub PoC★ 10
GhostLock (CVE-2026-43499) exploit adapted for Honor AAK-AN00 (MagicOS 10, kernel 6.6.89-android15) 声明，由于 AI 过于弱智 导致大量 token 被消耗 这导致资金严重不足在短时间内将不会更新 下次更新最早两天后
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-43499 x86 Exploit
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
George0Papasotiriou/CVE-2026-11112-XXE-via-SVG-Image-Upload
Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remo
48RIESGO
abrir ↗GitHub PoC★ 1
Technical analysis and proof of concept (PoC) for CVE-2025-55182 (React2Shell), a critical RCE vulnerability in React Server Components. Includes a Python tool, Docker lab, and documentation for reproduction and validation in authorized environments.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC★ 1
JVBotelho/cve-2026-69243-poc-aiohttp-smuggling
AIOHTTP: HTTP request smuggling via WebSocket upgrade
33RIESGO
abrir ↗GitHub PoC★ 1
Apache HTTP Server 2.4.x mod_lua Buffer Overflow (CVE-2021-44790) - Advanced exploitation framework with fingerprinting, multi-stage scanning, plugin architecture, professional reporting, screenshot capture, SQLite database, and 95%+ confidence detection. Author: Sudeepa Wanigarathna.
Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
45RIESGO
abrir ↗GitHub PoC
CVE-2026-13934
Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote a
48RIESGO
abrir ↗GitHub PoC★ 3
GhostLock (CVE-2026-43499) kernel exploit for samsung devices with locked bootloader
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗GitHub PoC
George0Papasotiriou/CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data v
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.