Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.780exploits catalogados
39.319CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
16.249 exploits
GitHub PoC
Goal is to triage well known attacks and learn how security teams quickly respond.
Microsoft Exchange Server Remote Code Execution Vulnerability
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-56782 — Gorse <0.5.10 unauthenticated DB dump/restore (admin_api_key fail-open). Lab + PoC, verified e2e.
Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints
63RIESGO
abrir ↗GitHub PoC
Goal is to triage well known attacks and learn how security teams quickly respond.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗GitHub PoC
rufflabs/crushftp_cve-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RIESGO
abrir ↗GitHub PoC
cve-2026-46331-audit script
net/sched: fix pedit partial COW leading to page cache corruption
41RIESGO
abrir ↗GitHub PoC★ 1
rootdirective-sec/CVE-2026-28496-Lab
FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE
63RIESGO
abrir ↗GitHub PoC★ 4
CVE-2026-48907 – Joomla JCE Unauthenticated Remote Code Execution (RCE)
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
98RIESGO
abrir ↗GitHub PoC
drupal-postgresql-rce
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
98RIESGO
abrir ↗GitHub PoC
rufflabs/ludus_crushftp_cve-2025-31161_sim
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RIESGO
abrir ↗GitHub PoC
HutTwoThreeFour/CVE-2026-5562-Exploit
provectus kafka-ui Endpoint testexecutions validateAccess code injection
48RIESGO
abrir ↗GitHub PoC
Goal is to triage well known attacks and learn how security teams quickly respond.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-46817
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi
78RIESGO
abrir ↗GitHub PoC
rufflabs/ludus_crushftp_cve-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RIESGO
abrir ↗GitHub PoC★ 2
Python poc, exploit for CVE-2025-69212
Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect
33RIESGO
abrir ↗GitHub PoC
Double-free in Apache httpd mod_http2 stream cleanup leading to pre-auth RCE
Apache HTTP Server: http2: double free and possible RCE on early reset
53RIESGO
abrir ↗GitHub PoC
Goal is to triage well known attack and learn how security teams quickly respond.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
Unauthenticated RCE PoC for CVE-2026-48908 SP Page Builder (Joomla) arbitrary file upload and remote code execution exploit with mass scaning support.
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
100RIESGO
abrir ↗GitHub PoC★ 192
CVE-2026-41940 authentication bypass vulnerability proof-of-concept
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RIESGO
abrir ↗GitHub PoC
Why-Shell/CVE-2026-38751
OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionali
41RIESGO
abrir ↗GitHub PoC★ 6
CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9
net/sched: fix pedit partial COW leading to page cache corruption
41RIESGO
abrir ↗GitHub PoC★ 3
DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503
net: skbuff: propagate shared-frag marker through frag-transfer helpers
56RIESGO
abrir ↗GitHub PoC
Hack The Box - DevHub Machine Walkthrough (Medium Linux, CVE-2026-23744, Chisel Tunneling, Jupyter, Root Privilege Escalation)
REC in MCPJam inspector due to HTTP Endpoint exposes
75RIESGO
abrir ↗GitHub PoC
Goal is to triage well known attack and learn how security teams quickly respond.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗GitHub PoC
React2Shell: CVE-2025-55182 exploit from tryhackme‼️
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-12485
GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-49048 — JoomCCK 6.4.0 Unauthenticated SQL Injection (CVSS 9.8)
Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1
41RIESGO
abrir ↗GitHub PoC
POC for CVE-2026-41179
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
63RIESGO
abrir ↗GitHub PoC
solmin111/OpenSMTPD-CVE-2020-7247-
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
100RIESGO
abrir ↗GitHub PoC★ 64
cve-2026-48907 scanner
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
98RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.