Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.809exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.234VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.809 exploits
VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
CVE-2026-109619: cross-request UAF in PHP session.upload_progress — reproduction, root-cause analysis and full chain to RCE
RCE via stale global state
100RIESGO
abrir ↗GitHub PoC
Detection and inventory tool for PHP core CVE-2026-109618 and CVE-2026-109619: finds PHP installs, checks versions and mitigating settings, never triggers the bugs. Python 3 standard library only.
RCE via OOM corruption
100RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗GitHub PoC
Notbetrieb für PHP, das sich nicht patchen lässt. Kein Fix für CVE-2026-109618 und CVE-2026-109619.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
php:7.4-fpm drop-in rebuilt with the CVE-2026-109618/109619 fix (PHP2Shell)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 3
Pre-auth remote code execution & reverse shell PoC for CVE-2026-109618 / CVE-2026-109619 - PHP core session upload-progress. One URL in, a reverse shell out.
RCE via OOM corruption
100RIESGO
abrir ↗VulnCheck XDB
client-side
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RIESGO
abrir ↗GitHub PoC★ 111
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
PHP Serializable var_hash UAF -> RCE (CVE-2026-109618/619): independent reproduction, 7.4-8.5 weaponization matrix, session-decode path, offset probe, ASAN evidence, and the fake-writeup falsification
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Reproducer for CVE-2026-85316 — Apache Camel camel-platform-http unintended proxy mode from a path prefix (CWE-1220). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching
33RIESGO
abrir ↗GitHub PoC
PHP Portal Audit: URL-only risk signals for CVE-2026-109618 / CVE-2026-109619, runtime assessment and optional multipart reachability evidence. No exploitation.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
dave-ojumoola/CYB-401-CVE-2021-44228-Log4Shell
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
Passive check for Claude whether a website or server runs a PHP version affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
Non-destructive detection toolkit + version-differential oracle for PHP2Shell (CVE-2026-109618/109619). Leak oracle verified 4/4 on PHP 8.5.11 vs 0/4 on 8.5.12. Docker lab included.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
Security patch backports for EOL PHP (7.3/7.4): CVE-2026-109618/109619 full backport, Tier1/Tier2 CVEs. Unofficial, community effort.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 17
Nodejs漏洞 CVE-2026-111497 POC
Out-of-Bounds Write in Google Brotli Decoder
70RIESGO
abrir ↗GitHub PoC
Cybersecurity research and vulnerability analysis
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.