Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.933exploits catalogados
40.796CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.326VulnCheck XDB 10.507Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
87.940 exploits
VulnCheck XDB
info-leak
Apache Flink directory traversal attack: reading remote files through the REST API
100RIESGO
abrir ↗VulnCheck XDB
initial-access
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
63RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker
100RIESGO
abrir ↗VulnCheck XDB
initial-access
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack
100RIESGO
abrir ↗VulnCheck XDB
info-leak
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RIESGO
abrir ↗GitHub PoC
Penetration test of Apache Tomcat — Ghostcat, CVE-2017-12615 and Struts2/OGNL exploitation with MITRE ATT&CK mapping
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati
100RIESGO
abrir ↗GitHub PoC★ 1
Atlassian Arbitrary File Read
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC
AmalJafarzade/CVE-2026-104586
AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.
48RIESGO
abrir ↗GitHub PoC
Vulhub bash/CVE-2014-6271: Shellshock through Apache CGI, run with Isoloom
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗GitHub PoC
Vulhub spring/CVE-2022-22947: Spring Cloud Gateway Actuator Code Injection (CVE-2022-22947), run with Isoloom
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RIESGO
abrir ↗GitHub PoC
Vulhub httpd/CVE-2021-42013: Apache HTTP Server 2.4.50 Path Traversal and RCE (CVE-2021-42013), run with Isoloom
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RIESGO
abrir ↗GitHub PoC
Vulhub nginx/CVE-2013-4547: Nginx Filename Logic Vulnerability (CVE-2013-4547), run with Isoloom
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
35RIESGO
abrir ↗GitHub PoC★ 1
Hands-on vulnerability analysis and non-destructive verification of the vsftpd 2.3.4 backdoor (CVE-2011-2523) in an isolated lab.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗GitHub PoC
Vulhub openssl/CVE-2014-0160: Heartbleed on nginx with OpenSSL 1.0.1c, run with Isoloom
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RIESGO
abrir ↗GitHub PoC
Vulhub php/CVE-2012-1823: PHP-CGI Query String Argument Injection (CVE-2012-1823), run with Isoloom
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
100RIESGO
abrir ↗GitHub PoC
Vulhub superset/CVE-2023-27524: Apache Superset Default SECRET_KEY Session Forgery (CVE-2023-27524), run with Isoloom
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
100RIESGO
abrir ↗GitHub PoC
Vulhub postgres/CVE-2019-9193: PostgreSQL COPY FROM PROGRAM Command Execution (CVE-2019-9193), run with Isoloom
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RIESGO
abrir ↗GitHub PoC
Atlassian Data Center Multiple Products - Arbitrary File Access (Path Traversal)
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC★ 1
Detection PoC for CVE-2026-5430 — unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0–4.6.0. Read-only assessment tool with patch confirmation and WAF detection. Authorized use only.
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
83RIESGO
abrir ↗GitHub PoC
Vulhub supervisor/CVE-2017-11610: Supervisord XML-RPC RCE (CVE-2017-11610), run with Isoloom
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows rem
60RIESGO
abrir ↗GitHub PoC
Triage scanner for CVE-2025-57819 (FreePBX Endpoint Manager unauthenticated SQLi to RCE). Detection only, no payloads.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗GitHub PoC
CVE-2026-21589 is a critical (CVSS 9.3) arbitrary file access vulnerability affecting all versions of eight Atlassian Data Center products, including Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye, and Jira Service Management.
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Soft
100RIESGO
abrir ↗GitHub PoC
Vulhub shiro/CVE-2016-4437: Shiro 1.2.4 rememberMe deserialization, run with Isoloom
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack
100RIESGO
abrir ↗GitHub PoC
Vulhub webmin/CVE-2019-15107: Webmin password_change.cgi Pre-Auth RCE (CVE-2019-15107), run with Isoloom
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RIESGO
abrir ↗GitHub PoC
Analisi e sfruttamento pratico della CVE-2026-46300 (Fragnesia) per l'ottenimento di Initial Access in un ambiente di test.
net: skbuff: preserve shared-frag marker during coalescing
91RIESGO
abrir ↗GitHub PoC
Vulhub activemq/CVE-2016-3088: ActiveMQ Fileserver Arbitrary File Write (CVE-2016-3088), run with Isoloom
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitr
100RIESGO
abrir ↗GitHub PoC
Vulhub tomcat/CVE-2020-1938: Apache Tomcat AJP Ghostcat (CVE-2020-1938), run with Isoloom
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.