Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.899exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.900 exploits
VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗VulnCheck XDB
initial-access
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RIESGO
abrir ↗VulnCheck XDB
initial-access
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o
100RIESGO
abrir ↗GitHub PoC★ 533
cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RIESGO
abrir ↗GitHub PoC
FreePBX unauthenticated SQLi (endpoint module)
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
48RIESGO
abrir ↗GitHub PoC★ 6
CVE-2026-102489 exploit in golang
Undisclosed RCE in Zammad v6.3 and higher
83RIESGO
abrir ↗GitHub PoC
Farih123/CVE-2026-104335
Langflow OSS is affected by multiple vulnerabilities
41RIESGO
abrir ↗GitHub PoC
CVE-2026-105306: Token Introspection Audience Bypass via Dynamic Client Registration in Keycloak - Writeup by DungSoCool
Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration
33RIESGO
abrir ↗GitHub PoC
ctroy999/CVE-2026-107406
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
48RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗VulnCheck XDB
info-leak
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RIESGO
abrir ↗VulnCheck XDB
initial-access
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows rem
60RIESGO
abrir ↗GitHub PoC
Unauthenticated RCE in WordPress Forminator Forms <= 1.56.1 (CVSS 9.8)
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
48RIESGO
abrir ↗GitHub PoC★ 1
Reactor es una máquina Linux fácil vulnerable a CVE-2025-55182 (React2Shell), RCE sin autenticación en React Server Components. Accedemos como node, crackeamos un hash MD5 de una base de datos SQLite y pivotamos a engineer por SSH. La escalada abusa del flag --inspect de Node.js para ejecutar código como root vía depuración V8.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗GitHub PoC
Binary diff analysis and non-destructive PoC for CVE-2026-43805
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequ
48RIESGO
abrir ↗GitHub PoC
PoC CVE-2026-104286 FortiMail
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RIESGO
abrir ↗GitHub PoC
toyplan/cve-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
63RIESGO
abrir ↗VulnCheck XDB
local
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗GitHub PoC
**CVE-2026-69414** is an elevation of privilege vulnerability in the **Microsoft Malware Protection Engine** (part of Windows Defender / Microsoft Defender Antivirus), publicly referred to as **"RoguePlanet"**. It represents a **patch bypass** of the original vulnerability **CVE-2026-50656**.
Microsoft Defender Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC★ 12
Reproducible macOS automountd research and lab PoCs for CVE-2026-84568 and CVE-2026-84570: fstype path traversal, NFS payload delivery, Gatekeeper behavior, and root code execution.
A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS S
41RIESGO
abrir ↗VulnCheck XDB
info-leak
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RIESGO
abrir ↗GitHub PoC★ 20
Telegram CVE-2026-107181
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RIESGO
abrir ↗VulnCheck XDB
initial-access
WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability
48RIESGO
abrir ↗GitHub PoC★ 1
AppleFDEKeyStore poc
A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27. A local atta
48RIESGO
abrir ↗GitHub PoC
MIT-licensed braces 3.0.3 with reviewed CVE-2026-93687 depth backport; pinned consumption only
braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.