Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.886exploits catalogados

32.153CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8176Nuclei 4202Metasploit 3462✓ solo verificadosrecientes populares riesgo

71.886 exploits

GitHub PoC

Log4Shell (CVE-2021-44228) defense lab — nginx + Coraza WAF dynamic module + OWASP CRS v4. Educational use only.

CVE-2021-44228CRITICALbajo ataqueransomware28 abr 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-44228CRITICALbajo ataqueransomware28 abr 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

kaleth4/CVE-2021-44228

CVE-2021-44228CRITICALbajo ataqueransomware27 abr 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

Analysis and PoC for CVE-2018-14847, MikroTik RouterOS Winbox information disclosure vulnerability allowing unauthenticated read access to the credential database.

CVE-2018-14847CRITICALbajo ataque27 abr 2026

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated

100RIESGO

abrir ↗

GitHub PoC

Multiple CVEs (CVE-2026-38934, CVE-2026-38935, CVE-2026-38936) discovered in diskover-community including CSRF and XSS vulnerabilities with proof-of-concept and impact analysis.

CVE-2026-38934HIGH27 abr 2026

Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker

41RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2018-14847CRITICALbajo ataque27 abr 2026

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated

100RIESGO

abrir ↗

GitHub PoC★ 1

melikesraoz/cve-2022-39227-jwt-auth-bypass-demo

CVE-2022-39227CRITICAL27 abr 2026

Python-jwt subject to Authentication Bypass by Spoofing

48RIESGO

abrir ↗

GitHub PoC

A black box penetration test on HackTheBox's CCTV machine achieving full root compromise via four vulnerabilities: default credentials, SQL injection (CVE-2024-51482), password hash cracking, and Remote Code Execution in motionEye (CVE-2025-60787)

CVE-2025-60787HIGH26 abr 2026

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name

61RIESGO

abrir ↗

GitHub PoC

CVE-2024-51482CRITICAL26 abr 2026

Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64

75RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALbajo ataque26 abr 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-41773HIGHbajo ataqueransomware25 abr 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-39987CRITICALbajo ataque25 abr 2026

marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-0740CRITICAL25 abr 2026

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

75RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-3844CRITICAL25 abr 2026

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

75RIESGO

abrir ↗

VulnCheck XDB

local

CVE-2023-32629HIGH25 abr 2026

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks

56RIESGO

abrir ↗

GitHub PoC

patch-manager

CVE-2019-14287—25 abr 2026

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and se

35RIESGO

abrir ↗

GitHub PoC

Web application penetration testing project targeting a WordPress environment. Includes exploitation of CVE-2019-9978, reverse shell execution, post-exploitation steps, and full pentesting report.

CVE-2019-9978MEDIUMbajo ataque25 abr 2026

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RIESGO

abrir ↗

GitHub PoC

CVE-2024-3273 — Authorized Penetration Test Report D-Link DNS-320L NAS | Client: Otonata

CVE-2024-3273HIGHbajo ataque25 abr 2026

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

100RIESGO

abrir ↗

GitHub PoC★ 1

im2sinister/CVE-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware25 abr 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC

CMS Simple CVE Recode Script Python 3

CVE-2019-9053—25 abr 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RIESGO

abrir ↗

GitHub PoC

bhatbhupendra/Moniker-Link--CVE-2024-21413-

CVE-2024-21413CRITICALbajo ataque25 abr 2026

Microsoft Outlook Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC

LoGGGG2402/CVE-2025-27407

CVE-2025-27407CRITICAL25 abr 2026

Remote code execution when loading a crafted GraphQL schema

48RIESGO

abrir ↗

GitHub PoC

Some Proof-of-Concept (POCs) for CVE-2025-29927, CVE-2026-27978, and CVE-2026-29057 in Next.js.

CVE-2025-29927CRITICAL25 abr 2026

Authorization Bypass in Next.js Middleware

85RIESGO

abrir ↗

GitHub PoC

Cybersecurity-Enthusiasts-CE/CVE-2025-55182-Researching-process

CVE-2025-55182CRITICALbajo ataqueransomware25 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

DONKEY0xSHOT/CVE-2017-11882-Blocker

CVE-2017-11882HIGHbajo ataqueransomware25 abr 2026

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-47812CRITICALbajo ataque24 abr 2026

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o

100RIESGO

abrir ↗

GitHub PoC

Bug Bounty: CVE-2023-50839 IDOR identified in a third-party support component via 'gau' and 'Nuclei'. Despite perimeter redirects, the outdated software remained exposed. Confirmed through manual header analysis. Severity: 5.3 (Medium). Focused on Defense in Depth failures and PII protection. Status: Reported on Intigriti.

CVE-2023-50839CRITICAL24 abr 2026

WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection

63RIESGO

abrir ↗

GitHub PoC

Poc for React2Shell CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware24 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

HTB Season 10 - Pterodactyl machine writeup. Medium Linux box covering CVE-2025-49132 (Pterodactyl Panel RCE) and CVE-2025-6018/6019 (udisks2 privilege escalation).

CVE-2025-49132CRITICAL24 abr 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

68RIESGO

abrir ↗

GitHub PoC

AbokorMAHAMMADMOUSSE/CVE-2025-25279-Mattermost-Path-Traversal

CVE-2025-25279CRITICAL24 abr 2026

Arbitrary file read in Mattermost Boards via import & export board archive

53RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.