Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
71.062exploits catalogados
31.617CVEs con explotación pública
0probados en laboratorio
TodosExploit-DB 22.467Referência 19.791GitHub PoC 13.086VulnCheck XDB 8069Nuclei 4187Metasploit 3462✓ solo verificadosrecientespopularesriesgo
13.086 exploits
GitHub PoC
CVE-2026-54807 WooCommerce Privilege Escalation ║ ║ Unauthenticated Admin Role Assignment via Reg. Form
WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability
48RIESGO
abrir ↗GitHub PoC
A public share looked clean in the page tree, but the search endpoint told a different story. In Docmost, restricted child pages hidden from public share viewers could still leak through public share search results.
Docmost's Public Share Search Exposes Metadata of Restricted Children
33RIESGO
abrir ↗GitHub PoC
Plane’s V2 asset subsystem trusted workspace slugs and asset UUIDs without enforcing the right membership checks, which let one authenticated user read, copy, delete, and overwrite assets in other workspaces.
Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces
41RIESGO
abrir ↗GitHub PoC
fevar54/CVE-2026-20253-Splunk-Enterprise-Pre-Auth-RCE-
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
100RIESGO
abrir ↗GitHub PoC★ 15
mooder1/dirtyclone-CVE-2026-43503
net: skbuff: propagate shared-frag marker through frag-transfer helpers
41RIESGO
abrir ↗GitHub PoC★ 3
CVE-2026-20251 — Splunk Secure Gateway jsonpickle deserialization RCE (CVSS 8.8) | ReactiveZero Security Research
Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway
41RIESGO
abrir ↗GitHub PoC★ 4
aexdyhaxor/CVE-2026-43503-DirtyClone
net: skbuff: propagate shared-frag marker through frag-transfer helpers
41RIESGO
abrir ↗GitHub PoC
Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering.
Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url
38RIESGO
abrir ↗GitHub PoC★ 4
CVE-2026-8461
Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder
41RIESGO
abrir ↗GitHub PoC
12hrformat/CVE-2026-35273-POC
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana
100RIESGO
abrir ↗GitHub PoC
e-corp-demo/CVE-2026-44788
SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)
33RIESGO
abrir ↗GitHub PoC
POC of CVE-2026-53075
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
41RIESGO
abrir ↗GitHub PoC★ 24
CVE-2026-43503
net: skbuff: propagate shared-frag marker through frag-transfer helpers
41RIESGO
abrir ↗GitHub PoC
Squamity/CVE-2026-8181-PoC
Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
68RIESGO
abrir ↗GitHub PoC
7whyex/CVE-2026-45321-Tanstack
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
78RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-7574
Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use
41RIESGO
abrir ↗GitHub PoC★ 1
W5M1n9/Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230
Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
53RIESGO
abrir ↗GitHub PoC
CVE-2026-31431 getroot from a Turkish Cryptominer
crypto: algif_aead - Revert to operating out-of-place
100RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-48908
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
48RIESGO
abrir ↗GitHub PoC
Unauthenticated RCE PoC for CVE-2026-48908 SP Page Builder (Joomla) arbitrary file upload and remote code execution exploit with mass scaning support.
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
48RIESGO
abrir ↗GitHub PoC
CVE-2026-48908 - SP Page Builder Joomla Unauthenticated RCE
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
48RIESGO
abrir ↗GitHub PoC
Proof of Concept of CVE-2026-38526 in Krayin CRM <= v2.2.x. Arbitrary File Upload leading to Remote Code Execution
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RIESGO
abrir ↗GitHub PoC
CVE-2026-49777, CVE-2026-10735 - Draft
WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability
63RIESGO
abrir ↗GitHub PoC★ 1
Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter | Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover
Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter
48RIESGO
abrir ↗GitHub PoC★ 1
CVE-2026-8461 - Draft
Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder
41RIESGO
abrir ↗GitHub PoC★ 13
Y5neKO/CVE-2026-8461-EXP
Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder
41RIESGO
abrir ↗GitHub PoC★ 1
Proof of concept for CVE-2026-56111, an out-of-bounds write in the M421 G-code handler of Marlin Firmware
Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler
41RIESGO
abrir ↗GitHub PoC★ 60
CVE-2026-45504 Microsoft Exchange File Read
Microsoft Exchange Server Elevation of Privilege Vulnerability
41RIESGO
abrir ↗GitHub PoC★ 3
Proof of Concept (PoC) for the TP-Link DHCP Option 66 Unauthenticated RCE (CVE-2026-11834)
Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers
41RIESGO
abrir ↗GitHub PoC★ 1
A minimal PoC for CVE-2026-21018, demonstrating how it works
Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.