Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.853exploits catalogados

39.383CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.269 exploits

GitHub PoC

Fork of laravel/framework 10.50.2 with CVE-2026-48019 (CRLF injection in default email rule) backported into ValidatesAttributes::validateEmail. Tagged 10.51.0.

CVE-2026-48019HIGH14 jun 2026

CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

41RIESGO

GitHub PoC

CVE-2026-5513: Bookly <= 27.2 Stored XSS via Cookie (Unauthenticated)

CVE-2026-5513HIGH14 jun 2026

Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie

41RIESGO

GitHub PoC

Python RCE PoC with reverse-shell listener for CVE-2026-42945 (NGINX Rift)

CVE-2026-42945CRITICAL14 jun 2026

NGINX ngx_http_rewrite_module vulnerability

48RIESGO

GitHub PoC

CVE-2026-20127

CVE-2026-20127CRITICALbajo ataque14 jun 2026

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

100RIESGO

GitHub PoC★ 1

rohit-sundar/cve-2026-23744

CVE-2026-23744CRITICAL14 jun 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

GitHub PoC★ 4

CVE-2026-20245

CVE-2026-20245HIGHbajo ataque14 jun 2026

Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability

76RIESGO

GitHub PoC

CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie

CVE-2026-5513HIGH14 jun 2026

Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie

41RIESGO

GitHub PoC★ 1

Defensive research notes for CVE-2026-5950, a BIND 9 resolver DoS vulnerability credited to Billy Baraja (BielraX).

CVE-2026-5950MEDIUM14 jun 2026

Unbounded resend loop in BIND 9 resolver

33RIESGO

GitHub PoC★ 1

CVE-2024-3094 XZ Utils backdoor research - attack surface visualiser, system vulnerability checker, and general Linux CVE assessment tool

CVE-2024-3094CRITICAL14 jun 2026

Xz: malicious code in distributed source

70RIESGO

GitHub PoC

Apache HTTP Server 2.4.49 Path Traversal Vulnerability Reproduction

CVE-2021-41773HIGHbajo ataqueransomware14 jun 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

GitHub PoC

CVE-2025-14847 mongobleed python file

CVE-2025-14847HIGHbajo ataque14 jun 2026

Zlib compressed protocol header length confusion may allow memory read

100RIESGO

GitHub PoC★ 2

razureink/cve-2026-49975-http2bomb_reproduction

CVE-2026-49975HIGH13 jun 2026

Apache HTTP Server: mod_http2 denial of service

41RIESGO

GitHub PoC★ 1

HTTP/2 Bomb: HPACK indexed-reference amplification + flow-control stall. A high school student's full protocol analysis (LaTeX). CVE-2026-49975, CVE-2026-47774.

CVE-2026-49975HIGH13 jun 2026

Apache HTTP Server: mod_http2 denial of service

41RIESGO

GitHub PoC

J1nKsC/CVE-2024-4367_test

CVE-2024-4367MEDIUM13 jun 2026

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RIESGO

GitHub PoC★ 1

Hunt-Benito/glinet-beryl-ax-triple-rce-cve-2026-11450-11451-11452-unauthenticated-root-on-travel-router

CVE-2026-11450MEDIUM13 jun 2026

GL.iNet GL-MT3000 Path Normalization dlopen command injection

33RIESGO

GitHub PoC

CVE-2018-9276 — PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.

CVE-2018-9276HIGHbajo ataque13 jun 2026

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra

100RIESGO

GitHub PoC

Some labs looking at the xz backdoor vulnerability (CVE-2024-3094)

CVE-2024-3094CRITICAL13 jun 2026

Xz: malicious code in distributed source

70RIESGO

GitHub PoC★ 1

(phpBB authentication bypass)

CVE-2026-48611CRITICAL13 jun 2026

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or

63RIESGO

GitHub PoC

CVE-2018-9276 — PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.

CVE-2018-9276HIGHbajo ataque13 jun 2026

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra

100RIESGO

GitHub PoC

CVE-2025-55182 exploit script

CVE-2025-55182CRITICALbajo ataqueransomware13 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC★ 1

CVE-2026-6279

CVE-2026-6279CRITICAL13 jun 2026

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

48RIESGO

GitHub PoC

webshellseo8/CVE-2026-1555-POC

CVE-2026-1555CRITICAL13 jun 2026

WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload

48RIESGO

GitHub PoC

Remote Code Execution in DbGate via functionName injection in the loadReader endpoint — CVSS 8.8

CVE-2026-48017HIGH13 jun 2026

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

41RIESGO

GitHub PoC

AISec Plus Week 1 threat write-up — EchoLeak (CVE-2025-32711), zero-click indirect prompt injection in Microsoft 365 Copilot.

CVE-2025-32711CRITICAL13 jun 2026

M365 Copilot Information Disclosure Vulnerability

48RIESGO

GitHub PoC

87achrafg-stack/CVE-2026-6279

CVE-2026-6279CRITICAL13 jun 2026

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

48RIESGO

GitHub PoC★ 5

CVE-2026-20253

CVE-2026-20253CRITICALbajo ataque13 jun 2026

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

100RIESGO

GitHub PoC

rootdirective-sec/CVE-2026-42647-Lab

CVE-2026-42647CRITICAL13 jun 2026

WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability

63RIESGO

GitHub PoC

JupyterHub XSRF bypass via cross-origin form POST (Sec-Fetch-Mode: no-cors) — CWE-352

CVE-2026-40864MEDIUM13 jun 2026

JupyterHub: Cross-origin form POSTs bypass XSRF

33RIESGO

GitHub PoC

Technical writeup and Proof of Concept (PoC) for CVE-2026-11417: OS Command Injection / Remote Code Execution (RCE) in AWS CDK's NodejsFunction.

CVE-2026-11417HIGH13 jun 2026

OS Command Injection in NodejsFunction Bundling in aws-cdk-lib

41RIESGO

GitHub PoC

SQL Injection in Dagster database I/O managers via dynamic partition keys (DuckDB/Snowflake/BigQuery/DeltaLake) — High

CVE-2026-41490HIGH13 jun 2026

Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.