Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.780exploits catalogados
39.319CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
16.249 exploits
GitHub PoC
CVE-2012-1823 - PHP CGI Argument Injection Remote Code Execution (RCE)
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
100RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-43284 - CVE-2026-43500 - CVE-2026-46300 Variant of dirtyfrag exploit
net: skbuff: preserve shared-frag marker during coalescing
56RIESGO
abrir ↗GitHub PoC★ 12
app that ports CVE-2019-2215 to arm32 and mounts a su binary to /sbin with denylist + root app installer. firehose/Magisk guide included
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗GitHub PoC
CVE-2026-8037 - Draft
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
100RIESGO
abrir ↗GitHub PoC★ 3
Kestra Auth-Bypass Vulnerability Checker
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
78RIESGO
abrir ↗GitHub PoC
Defensive validation of CVE-2026-46331 / pedit COW with auditd, AppArmor, mitigation comparison and detection logic.
net/sched: fix pedit partial COW leading to page cache corruption
41RIESGO
abrir ↗GitHub PoC★ 13
watchtowrlabs/watchTowr-vs-Netscaler-CVE-2026-8451
Insufficient input validation leading to memory overread
41RIESGO
abrir ↗GitHub PoC★ 14
DirtySlide XNU Exploit (CVE-2026-43724) For MacOS
The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.
41RIESGO
abrir ↗GitHub PoC★ 2
Citrix NetScaler CVE Preconditions Checker as per CTX696604 | Supported CVE : CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474
Insufficient input validation leading to memory overread
41RIESGO
abrir ↗GitHub PoC
CVE-2026-46817 - Draft
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi
78RIESGO
abrir ↗GitHub PoC
Defensive validation of CVE-2026-46331 / pedit COW with auditd, AppArmor, mitigation comparison and detection logic.
net/sched: fix pedit partial COW leading to page cache corruption
41RIESGO
abrir ↗GitHub PoC
PoC exploit for CVE-2026-10580 - Authentication Bypass in Hippoo Mobile App for WooCommerce <= 1.9.4 leading to Admin Account Takeover
Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API
63RIESGO
abrir ↗GitHub PoC
CVE-2026-46490 — samlify <2.13.0 SAML AttributeValue XML injection -> signed-assertion privilege escalation. Self-contained PoC, verified e2e.
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
41RIESGO
abrir ↗GitHub PoC★ 1
CVE-2025-45422: Proximus b-box UPnP Persistence & Access Control Bypass
Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and mak
41RIESGO
abrir ↗GitHub PoC
CVE-2026-58138 — Conductor (3.21.21..<3.30.2) unauthenticated RCE via INLINE GraalVM evaluator (HostAccess.ALL). Lab + PoC, verified e2e (root).
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
68RIESGO
abrir ↗GitHub PoC
CVE-2026-56121 — Feast <0.63.0 unauthenticated RCE via gRPC registry dill.loads of OnDemandFeatureView UDF (pre-auth). Lab + PoC, verified e2e.
Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization
48RIESGO
abrir ↗GitHub PoC★ 16
Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a page-cache page by 24 bytes. PoC plus an unprivileged local-root exploit via /etc/passwd page-cache corruption. Run only inside a VM.
fuse: reject oversized dirents in page cache
41RIESGO
abrir ↗GitHub PoC
Chequeo y Fix de la vulnerabilidad "pedit COW"
net/sched: fix pedit partial COW leading to page cache corruption
41RIESGO
abrir ↗GitHub PoC★ 1
POC for CVE-2026-48907
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
98RIESGO
abrir ↗GitHub PoC
DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503
net: skbuff: propagate shared-frag marker through frag-transfer helpers
56RIESGO
abrir ↗GitHub PoC★ 4
CVE-2026-55200 - Critical libssh2 Remote Code Execution Vulnerability
libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
48RIESGO
abrir ↗GitHub PoC
Goal is to triage well known attacks and learn how security teams quickly respond.
Microsoft Exchange Server Remote Code Execution Vulnerability
100RIESGO
abrir ↗GitHub PoC
cve-2026-46331-audit script
net/sched: fix pedit partial COW leading to page cache corruption
41RIESGO
abrir ↗GitHub PoC★ 25
Python Proof of Concept for DirtyClone (CVE-2026-43503) - Linux kernel LPE via page-cache corruption
net: skbuff: propagate shared-frag marker through frag-transfer helpers
56RIESGO
abrir ↗GitHub PoC
xitexploiter96-dot/CVE-2026-48907-
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
98RIESGO
abrir ↗GitHub PoC
CVE-2026-53753 — Crawl4AI <0.8.7 unauthenticated RCE (AST sandbox escape via gi_frame.f_back). Lab + PoC, verified e2e.
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
63RIESGO
abrir ↗GitHub PoC
POC for CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
100RIESGO
abrir ↗GitHub PoC
Goal is to triage well known attacks and learn how security teams quickly respond.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗GitHub PoC★ 4
Pure C exploit for CVE-2023-4911 (Looney Tunables) — x86_64 & aarch64 implementations. Multi-processing brute-forcing, dynamic calibration, integrated ELF parser.
Glibc: buffer overflow in ld.so leading to privilege escalation
98RIESGO
abrir ↗GitHub PoC
rufflabs/ludus_crushftp_cve-2025-31161_sim
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.