Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.402exploits catalogados
39.049CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.184Exploit-DB 24.485GitHub PoC 16.124VulnCheck XDB 9617Nuclei 4473Metasploit 3519✓ solo verificadosrecientespopularesriesgo
16.124 exploits
GitHub PoC
Technical advisory and proof of concept for CVE-2026-97286 in the WordPress Strong Testimonials plugin
WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability
33RIESGO
abrir ↗GitHub PoC★ 10
MarcusProgram/CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗GitHub PoC★ 6
Zammad Session Leak to Remote Code Execution
Undisclosed RCE in Zammad v6.3 and higher
71RIESGO
abrir ↗GitHub PoC
PoC for CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
CVE-2025-55182 "Ghost Action" — pre-auth RCE (React Flight deserialization, Next.js 15.5.6) CTF challenge. Problem only; solve/writeup excluded.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
beyavuz/cve-2026-105080-poc
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-conve
48RIESGO
abrir ↗GitHub PoC
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
41RIESGO
abrir ↗GitHub PoC
Upstream OpenVPN kernel fix for CVE-2026-74727, tested on Ubuntu kernel 7.0.0-38.38. Includes build instructions and functional test results.
ovpn: skip rehash for peers already removed from by_id
48RIESGO
abrir ↗GitHub PoC★ 14
watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗GitHub PoC★ 1
PHP Object Injection -> Arbitrary File Deletion in FacturaScripts <= 2026.66 (CWE-502). PoC + advisory.
FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
33RIESGO
abrir ↗GitHub PoC
CVE-2026-63277,
RCE via calcext:data-mappings, sql provider and jdbc connector
41RIESGO
abrir ↗GitHub PoC
CVE-2023-54391: Proxmox VE Authentication Bypass RCE
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RIESGO
abrir ↗GitHub PoC★ 9
CVE-2026-21589 - Atlassian Data Center Unauth Arbitrary File Read (CVSS 9.3). Red/Blue Team suite with 2 tools: Full Exploit (path traversal, WEB-INF read, interactive shell, 8 products, mass scan, SOCKS5/Tor, stealth) and SafeChecker (non-intrusive version audit, WAF detection, IoC guidance, JSON/CSV/JSONL reports). Use Ethically, Stay Legal.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
63RIESGO
abrir ↗GitHub PoC
Python 3 reverse-shell exploit for Zenphoto <= 1.4.1.4 / CVE-2011-4825 (EDB-18083)
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinym
50RIESGO
abrir ↗GitHub PoC
CVE-2026-105221 - gist RubyGem - High - MITM - GitHub OAuth token theft
Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
48RIESGO
abrir ↗GitHub PoC
PoC for CVE-2026-67401 — cPanel/WHM EmailTrack SQL injection leading to arbitrary file write and root RCE. Includes a self-contained vulnerable lab, SQLi detection, and full exploit chain.
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-96940
Microsoft Exchange Server Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC★ 2
CVE-2023-54391: Proxmox VE Authentication Bypass RCE Exploit
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-57967 PoC — Apache ActiveMQ Artemis unauthenticated session hijacking via SESSION_REATTACH (2.50.0–2.56.0)
Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
48RIESGO
abrir ↗GitHub PoC★ 1
0xCyp1337/CVE-2026-10196
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
48RIESGO
abrir ↗GitHub PoC
One-day analysis + sanitizer PoC of CVE-2026-43805 (IOKit IODMACommand DriverKit RPC race, CWE-362)
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequ
48RIESGO
abrir ↗GitHub PoC
Penetration test for Metasploitable 2 — Samba 3.0.20 Username Map Script (CVE-2007-2447)
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RIESGO
abrir ↗GitHub PoC
Educational lab and clean-room reproduction demonstrating the OS command injection pattern in CVE-2026-105134. For defensive research only.
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
78RIESGO
abrir ↗GitHub PoC
CVE-2026-39987 Exploit | by infrar3d
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RIESGO
abrir ↗GitHub PoC
CVE-2024-4367 PDF.js FontMatrix injection PoC (payload: alert(1)) - authorized pentest artifact
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RIESGO
abrir ↗GitHub PoC
Analysis of CVE-2026-86881: An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages
A certificate validation issue was addressed with improved certificate validation. This issue is fixed in iOS 26.7 and i
48RIESGO
abrir ↗GitHub PoC
Xen0nize/CVE-2026-21096
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attac
48RIESGO
abrir ↗GitHub PoC
CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RIESGO
abrir ↗GitHub PoC
PoC and automated code to exploit CVE-2025-57819 in FreePBX. It demonstrates the Remote Code Execution (RCE) vulnerability via command injection in the Asterisk system. Ideal for HackTheBox environments.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗GitHub PoC
CVE-2026-16444 — Arbitrary file write on the controller via TeamViewer Classical File Transfer (TV-2026-1008)
Improper Validation of File Paths in TeamViewer Desktop Clients
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.