Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.899exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.899 exploits
GitHub PoC★ 2
Local Docker trigger reproductions for PHP CVE-2026-109618 and CVE-2026-109619 advisories
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
Python HTTP/HTTPS response inspection tool for authorized web security research related to PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Cybersecurity research and vulnerability analysis
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
33RIESGO
abrir ↗GitHub PoC
Incident-response tabletop exercise artifacts for the Log4Shell (CVE-2021-44228) drill
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗GitHub PoC
Emergency mitigation guide and snippets for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Reproducer for CVE-2026-85315 — Apache Camel camel-grpc consumer exception disclosure (CWE-209). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions
33RIESGO
abrir ↗GitHub PoC
CVE-2026-109619: cross-request UAF in PHP session.upload_progress — reproduction, root-cause analysis and full chain to RCE
RCE via stale global state
100RIESGO
abrir ↗GitHub PoC
Reproducer for CVE-2026-85317 — Apache Camel camel-http OAuth2 token cache confusion (CWE-524). Camel Spring Boot.
Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache
33RIESGO
abrir ↗GitHub PoC
CVE-2026-97629 — nginx TLS session-ticket forgery that can bypass client-certificate (mTLS) authentication. Root cause, one-line patch, proof-of-concept exploit and reproduction evidence. Found and disclosed by PhiNode Labs; credited by F5. Fixed in nginx 1.31.7 / 1.30.6.
NGINX ngx_http_ssl_module vulnerability
41RIESGO
abrir ↗GitHub PoC★ 3
Safely verify the October 2026 PHP OOM security fixes by testing patched runtime behaviour
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 17
Unofficial PHP 7.4.33 RPMs for CentOS 7/EL7 with the PHP2Shell (CVE-2026-109618/109619) mitigation
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
Live monitor for PHP2Shell exploitation (CVE-2026-109618/109619)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
Ansible Playbook that runs through your PHP-FPM and OpenLiteSpeed PHP files and applies a mitigation against CVE-2026-109619.
RCE via stale global state
100RIESGO
abrir ↗GitHub PoC★ 2
Срочное обновление PHP 8.2.34 → 8.2.35 на BitrixVM 9 сборкой из исходников (CVE-2026-109618, CVE-2026-109619)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Reproducer for CVE-2026-91858 — Apache Camel camel-fop XML External Entity (XXE) via a third-party TransformerFactory (CWE-611). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present
33RIESGO
abrir ↗GitHub PoC
Reproducer for CVE-2026-88900 — Apache Camel camel-jgroups unsafe Java deserialization of cluster messages (CWE-502, HIGH). Camel Spring Boot.
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution
41RIESGO
abrir ↗GitHub PoC★ 7
Remediation scripts for PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, targeting HestiaCP and Plesk environments. Automates PHP configuration hardening and service reloads to help reduce exposure across supported PHP versions and hosting configurations.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
Did php2shell (CVE-2026-109618/109619) already own your servers? One read-only script to find out.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 2
php:7.4-fpm rebuilt from source with the official PHP2Shell backport (CVE-2026-109618 / CVE-2026-109619): the three things that break a 7.4 build in 2026, fixed
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Fix Php2Shell ( CVE-2026-109618 and CVE-2026-109619)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 1
The supplied report identifies `CVE-2026-109618` and `CVE-2026-109619` and targets PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. At the time this helper was prepared, those claims could not be confirmed from an official PHP advisory; do not treat a script message as proof of mitigation.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Temporary patched PHP base images (CVE-2026-109618/109619) until official images ship
RCE via OOM corruption
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.