Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.899exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.899 exploits
GitHub PoC
Incident-response tabletop exercise artifacts for the Log4Shell (CVE-2021-44228) drill
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
Notbetrieb für PHP, das sich nicht patchen lässt. Kein Fix für CVE-2026-109618 und CVE-2026-109619.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
WAF rules, PHP hardening & detection for CVE-2026-109618/109619 (PHP2Shell). Lab-tested bridge until you patch - review before production use.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
CVE-2026-86478 - JetBrains YouTrack Helpdesk unauthenticated account takeover via self-asserted email (CVSS 9.8)
In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthent
48RIESGO
abrir ↗GitHub PoC★ 6
Non-operational analysis and defensive guidance for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Plex2Shell (CVE-2026-96652/54/55/56) IOC/IOA dossier and read-only Windows hunt script
Plex Media Server SSRF
83RIESGO
abrir ↗Exploit-DB
Keycloak 26.7.2 - Unauthenticated Account Takeover
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RIESGO
abrir ↗GitHub PoC★ 132
php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC★ 2
Pre-auth RCE lab for CVE-2026-109618/CVE-2026-109619 - PHP session.upload_progress heap chain
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Serverbrede noodblokkade voor PHP2Shell (CVE-2026-109618 / CVE-2026-109619) voor DirectAdmin, Plesk, cPanel en kale Apache/nginx/LiteSpeed-servers
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
PHP の重大な脆弱性(CVE-2026-109618 / CVE-2026-109619)の確認の手順。読むだけで何も変更しない
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
BIBILZERODAY/CVE-2026-110372-MASS-EXPLOIT-WEBSHELL.STORE
WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability
43RIESGO
abrir ↗GitHub PoC★ 10
CVE-2026-109618 / CVE-2026-109619 Pre-auth RCE through PHP (session.upload_progress)
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Non-destructive affected-version checker for CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) PHP OOM/longjmp UAF
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
PHP2Shell Evaluación de CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
Cybersecurity assignment on CVE-2026-97859, severity analysis, patching, and the Cyber Kill Chain.
Gitea API disclosure of private user social graph, keys and stars
33RIESGO
abrir ↗GitHub PoC
Audit and interim mitigation scripts for PHP2Shell (CVE-2026-109618/109619) on Forge-managed Ubuntu servers
RCE via OOM corruption
100RIESGO
abrir ↗VulnCheck XDB
local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RIESGO
abrir ↗GitHub PoC★ 2
Local Docker trigger reproductions for PHP CVE-2026-109618 and CVE-2026-109619 advisories
RCE via OOM corruption
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.