Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.886exploits catalogados

32.153CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8176Nuclei 4202Metasploit 3462✓ solo verificadosrecientes populares riesgo

71.886 exploits

GitHub PoC

Bug Bounty: CVE-2023-50839 IDOR identified in a third-party support component via 'gau' and 'Nuclei'. Despite perimeter redirects, the outdated software remained exposed. Confirmed through manual header analysis. Severity: 5.3 (Medium). Focused on Defense in Depth failures and PII protection. Status: Reported on Intigriti.

CVE-2023-50839CRITICAL24 abr 2026

WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection

63RIESGO

GitHub PoC★ 1

its simple Shellshock exploit

CVE-2014-6271CRITICALbajo ataque24 abr 2026

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RIESGO

GitHub PoC

Poc for React2Shell CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware24 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

VulnCheck XDB

denial-of-service

CVE-2023-44487HIGHbajo ataque24 abr 2026

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many

93RIESGO

GitHub PoC

Unauthenticated_RCE.CVE-2025-47812

CVE-2025-47812CRITICALbajo ataque24 abr 2026

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o

100RIESGO

GitHub PoC

End-to-end SOC investigation: CVE-2011-2523 kill chain, multi-source log correlation, incident report — MITRE ATT&CK T1190

CVE-2011-2523—24 abr 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

GitHub PoC

HTB Season 10 - Pterodactyl machine writeup. Medium Linux box covering CVE-2025-49132 (Pterodactyl Panel RCE) and CVE-2025-6018/6019 (udisks2 privilege escalation).

CVE-2025-49132CRITICAL24 abr 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

68RIESGO

GitHub PoC

End-to-end cybersecurity project demonstrating detection and mitigation of CVE-2024-38063 using IDS, host-based monitoring, and virtual lab attack simulation.

CVE-2024-38063CRITICAL24 abr 2026

Windows TCP/IP Remote Code Execution Vulnerability

70RIESGO

GitHub PoC

AbokorMAHAMMADMOUSSE/CVE-2025-25279-Mattermost-Path-Traversal

CVE-2025-25279CRITICAL24 abr 2026

Arbitrary file read in Mattermost Boards via import & export board archive

53RIESGO

GitHub PoC★ 2

CVE-2025-68645

CVE-2025-68645HIGHbajo ataque24 abr 2026

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1

98RIESGO

VulnCheck XDB

initial-access

CVE-2026-21962CRITICAL24 abr 2026

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (compo

60RIESGO

GitHub PoC

POC exploit for CVE-2026-25895 FUXA Unauthenticated Path Traversal -> Arbitrary File Write -> RCE

CVE-2026-25895CRITICAL24 abr 2026

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

48RIESGO

VulnCheck XDB

initial-access

CVE-2026-3844CRITICAL24 abr 2026

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

75RIESGO

VulnCheck XDB

initial-access

CVE-2026-3844CRITICAL24 abr 2026

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

75RIESGO

VulnCheck XDB

initial-access

CVE-2026-3844CRITICAL24 abr 2026

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

75RIESGO

VulnCheck XDB

info-leak

CVE-2026-39813CRITICAL23 abr 2026

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.

53RIESGO

GitHub PoC

HackTheBox TwoMillion machine writeup — API abuse, command injection & CVE-2023-0386

CVE-2023-0386HIGHbajo ataque23 abr 2026

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa

86RIESGO

GitHub PoC

Find jenkins environment and checks for CVE-2024-23897

CVE-2024-23897CRITICALbajo ataqueransomware23 abr 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RIESGO

VulnCheck XDB

initial-access

CVE-2017-0144HIGHbajo ataqueransomware23 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

GitHub PoC

CVE-2024-3094

CVE-2024-3094CRITICAL23 abr 2026

Xz: malicious code in distributed source

70RIESGO

GitHub PoC★ 1

Recreation and analysis of a curious logic error in Apache 2.4.49 that escalated to remote code execution

CVE-2021-41773HIGHbajo ataqueransomware23 abr 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

GitHub PoC

Cybersecurity lab demonstrating exploitation of CVE-2017-0144 (EternalBlue) using Metasploit against a vulnerable Windows 7 VM, achieving SYSTEM-level access via Meterpreter. Includes full attack chain, post exploitation, and mitigation via MS17-010 patching, tested in an isolated ethical lab environment.

CVE-2017-0144HIGHbajo ataqueransomware23 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

GitHub PoC

End-to-end simulation of detecting a root-less Android Drop Device (Casper) using Wazuh SIEM to capture Layer 7 attacks like Shellshock (CVE-2014-6271).

CVE-2014-6271CRITICALbajo ataque22 abr 2026

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RIESGO

GitHub PoC

jpselva/CVE-2023-4863

CVE-2023-4863HIGHbajo ataque22 abr 2026

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to

93RIESGO

GitHub PoC★ 2

SQL Injection vulnerability in NASA EOSDIS MODAPS due to improper input validation in the `category` parameter. This flaw allows attackers to manipulate backend SQL queries, potentially leading to unauthorized data access and database compromise.

CVE-2024-46636CRITICAL22 abr 2026

NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection v

48RIESGO

GitHub PoC

Multi-Stage Attack Modeling and Detection of Log4Shell for CVE-2021-44228

CVE-2021-44228CRITICALbajo ataqueransomware22 abr 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC

Security toolkit for CVE-2025-55182 (React2Shell) — scan, detect, correlate, and test React Server Components RCE vulnerability

CVE-2025-55182CRITICALbajo ataqueransomware22 abr 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

VulnCheck XDB

info-leak

CVE-2022-3590MEDIUM22 abr 2026

WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

48RIESGO

GitHub PoC

Cybersecurity lab demonstrating exploitation of CVE-2017-0144 (EternalBlue) using Metasploit against a vulnerable Windows 7 VM, achieving SYSTEM-level access via Meterpreter. Includes full attack chain, post exploitation, and mitigation via MS17-010 patching, tested in an isolated ethical lab environment.

CVE-2017-0144HIGHbajo ataqueransomware22 abr 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

Metasploit600

Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload

CVE-2026-34413HIGH22 abr 2026

Xerte Online Toolkits Missing Authentication via connector.php

56RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.