Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.793exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.218VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.794 exploits
GitHub PoC
XAMPP for Windows の PHP を PHP2Shell（CVE-2026-109618 / CVE-2026-109619）修正版の PHP 8.2.35 に入れ替える非公式スクリプト
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
PHP2Shell (CVE-2026-109618/109619) one-click detect & fix tool
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 7
Node.js Brotli Decoder OOB Write to RCE
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗VulnCheck XDB
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RIESGO
abrir ↗GitHub PoC★ 1
FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients.
FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length
33RIESGO
abrir ↗GitHub PoC
Independent PHP2Shell lab: CVE-2026-109618/109619 differential validation, FastCGI harness and reproducible results
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
PoC demonstrations for PHP vulnerabilities CVE-2026-109618 & CVE-2026-109619
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Security update for CVE-2026-91403
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE
48RIESGO
abrir ↗GitHub PoC
PHP 8.5.12 binaries built for a Raspberry Pi 1B (armv6l+VFPv2). Stopgap solution for CVE-2026-109618 and CVE-2026-109619.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Demo of doc-review process using Log4Shell (CVE-2021-44228) advisory facts
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
Source + build recipe for the php2shell (CVE-2026-109618/109619) backport to CentOS 7 / IUS PHP 7.2
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
quick and simple powershell based Internal PHP Version Assessment Checks for PHP versions potentially vulnerable to: CVE-2026-109618 / CVE-2026-109619 (PHP2Shell)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Advanced Pre-Auth RCE Exploit for PHP session.upload_progress (CVE-2026-109618 & 109619) by Farhad Hosen.
RCE via stale global state
100RIESGO
abrir ↗GitHub PoC
Bluefire Redteam checker for Ivanti Connect Secure CVE-2026-104935. Version and reachability only.
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
100RIESGO
abrir ↗GitHub PoC
Unofficial backport of php commit (Avoid state corruption via bailout, branch PHP-7.4-CVE-2026-109618-109619) to the final PHP 7.2 release, 7.2.34. Not reviewed by the PHP team. Use as a bridge until you are on a supported PHP.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Research brief on Log4Shell (CVE-2021-44228) for an internal security awareness session. Every claim is backed by linked primary sources.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
Reproducible audit trail for the Log4Shell (CVE-2021-44228) and follow-up (CVE-2021-45046) study-group walkthrough
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC★ 6
CVE-2026-111497 — Node.js Brotli Decoder OOB Write: Deep Analysis & Structural Unreachability Proof. MLEN_MAX = BLOCK_SIZE_CAP = 2^24 makes RCE structurally unreachable.
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
Security advisory and PoC for CVE-2026-107079 affecting Systrome Validation & Certification 1.0.
An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parame
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.