Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.899exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.899 exploits
GitHub PoC
Toluwanimi7/CYB401-CVE-2026-58249-Analysis
Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
41RIESGO
abrir ↗GitHub PoC
Incident write-up: unsigned .so in the Plex Media Server codec cache executes a dropper on every transcode (CVE-2026-96656) — IOCs, STIX, YARA
Plex Media Server arbitrary file write
71RIESGO
abrir ↗VulnCheck XDB
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RIESGO
abrir ↗GitHub PoC★ 16
Zeek and Suricata Detections for "php2shell" CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RIESGO
abrir ↗GitHub PoC
danielakin417/CVE-2017-11882-analysis
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi
100RIESGO
abrir ↗GitHub PoC★ 2
Android/ARM64 port
mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
41RIESGO
abrir ↗GitHub PoC
a complete exploit chain for CVE-2026-982600,
exec: Cleanup POSIX timers right after de_thread()
41RIESGO
abrir ↗VulnCheck XDB
initial-access
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
63RIESGO
abrir ↗GitHub PoC
CVE-2015-2291 PoC: Arbitrary Kernel Calls via Intel NAL
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows all
76RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RIESGO
abrir ↗GitHub PoC
Fire ChatML/Mistral/Llama control-token literals at your self-hosted agent stack and prove role-forgery before an attacker does (CVE-2026-61732).
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
48RIESGO
abrir ↗GitHub PoC★ 1
Panduan Praktikum Edukasi: Deteksi Versi Cisco ASA & FTD (CVE-2026-20349)
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
71RIESGO
abrir ↗GitHub PoC
Reviewed isolated comparison lab for CVE-2026-71557
go-git: Malicious reference names may modify files outside the reference storage
33RIESGO
abrir ↗VulnCheck XDB
initial-access
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
60RIESGO
abrir ↗GitHub PoC★ 1
PoC for CVE-2026-92262, CVE-2026-85746, CVE-2026-85748 against MariaDB 13.0.1
MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
48RIESGO
abrir ↗GitHub PoC
CVE-2026-98180 — drm/msm use-after-free of the scheduler-containing ring and VM objects (fixed by 01c8d1f385f7)
drm/msm: RCU-free the scheduler-containing ring and VM objects
41RIESGO
abrir ↗GitHub PoC
PoC for CVE-2024-25600: unauthenticated RCE in WordPress Bricks Builder <=1.9.6. Extracts the render_element nonce, probes both REST endpoints, confirms exploitability, and opens an interactive shell. Usage: python3 bricks_rce.py -u <target>.
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RIESGO
abrir ↗GitHub PoC
PoC for CVE-2020-36847: unauthenticated file upload to RCE in WordPress Simple File List <=4.2.2. Uploads PHP as .png, renames to .php via ee-file-engine.php, verifies execution. Single target or batch mode. K52-ai.
Simple File List < 4.2.3 - Remote Code Execution
75RIESGO
abrir ↗GitHub PoC★ 2
Python-based security assessment tool for detecting exposed Vite development servers, identifying sensitive file exposure, and validating filesystem access control weaknesses in authorized environments.
Vite bypasses server.fs.deny when using `?raw??`
70RIESGO
abrir ↗GitHub PoC
Langflow 미인증 RCE 취약점(CVE-2025-3248) 기반 경량화 웹 해킹 CTF 문제 및 PoC 실습 환경
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RIESGO
abrir ↗GitHub PoC★ 1
fortbridge/cve-2026-108097-research
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
41RIESGO
abrir ↗GitHub PoC
kpatch livepatch build for CVE-2026-99999 on AlmaLinux 8/9 GA kernels
ipv4: validate checksum_start before completing checksum
48RIESGO
abrir ↗GitHub PoC
kingahmadr/CVE-2026-99999-kernel-check
ipv4: validate checksum_start before completing checksum
48RIESGO
abrir ↗GitHub PoC★ 5
CVE-2026-99999 PwnEscape PoC - Linux kernel IPv4 csum_start validation bug guest-to-host memory leak (CVSS 9.3)
ipv4: validate checksum_start before completing checksum
48RIESGO
abrir ↗GitHub PoC★ 2
A slow, from-zero walk through a Linux kernel privilege-escalation bug (CVE-2026-98260)
exec: Cleanup POSIX timers right after de_thread()
41RIESGO
abrir ↗GitHub PoC
kpatch livepatch build for CVE-2026-99999 on AlmaLinux 8/9 GA kernels
ipv4: validate checksum_start before completing checksum
48RIESGO
abrir ↗GitHub PoC
Reproducer for CVE-2026-80312 (Apache Camel camel-oauth): fail-open authentication guard — the OAuth processors returned control to the route instead of terminating when auth could not complete — Camel Spring Boot + Camel Quarkus
Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.