Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.853exploits catalogados

39.383CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.269 exploits

GitHub PoC★ 39

A demonstration of read write using cve-2025-43529 on iOS 26.1

CVE-2025-43529HIGHbajo ataque11 jun 2026

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

71RIESGO

abrir ↗

GitHub PoC

Escáner pasivo de seguridad para CVE-2025-55182 que identifica indicadores públicos asociados a Next.js y React Server Components. Realiza validaciones seguras, analiza cabeceras y rutas, y proporciona una evaluación de exposición basada en evidencias sin explotación.

CVE-2025-55182CRITICALbajo ataqueransomware11 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

FangFang-Yi/CVE-2024-30088

CVE-2024-30088HIGHbajo ataqueransomware11 jun 2026

Windows Kernel Elevation of Privilege Vulnerability

83RIESGO

abrir ↗

GitHub PoC

CVE-2026-45447 - Draft

CVE-2026-45447HIGH11 jun 2026

Heap Use-After-Free in the PKCS7_verify() Function

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-50507 - Draft

CVE-2026-50507MEDIUM11 jun 2026

Windows BitLocker Security Feature Bypass Vulnerability

33RIESGO

abrir ↗

GitHub PoC

byte16384/CVE-2026-49492-PoC

CVE-2026-49492HIGH11 jun 2026

Markdown Preview Enhanced OS Command Injection in External File and Link Opening

41RIESGO

abrir ↗

GitHub PoC

Cyber-DarkNay/CVE-2026-45034

CVE-2026-45034CRITICAL11 jun 2026

PhpSpreadsheet: File::prohibitWrappers bypass

48RIESGO

abrir ↗

GitHub PoC

anirudhmakkar/cve-2026-7665

CVE-2026-7665MEDIUM11 jun 2026

Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler

33RIESGO

abrir ↗

GitHub PoC

SangSenimanWartefak/CVE-2026-45034

CVE-2026-45034CRITICAL11 jun 2026

PhpSpreadsheet: File::prohibitWrappers bypass

48RIESGO

abrir ↗

GitHub PoC

Cyber-DarkNay/CVE-2025-6440

CVE-2025-6440CRITICAL11 jun 2026

WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload

60RIESGO

abrir ↗

GitHub PoC★ 16

PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5 unauthenticated RCE

CVE-2026-48907CRITICALbajo ataque11 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

98RIESGO

abrir ↗

GitHub PoC

CVE-2026-40791: Unauthenticated stored XSS in WP Time Slots Booking Form <= 1.2.46

CVE-2026-40791HIGH11 jun 2026

WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerability

41RIESGO

abrir ↗

GitHub PoC

leehunkoo/cve-2013-4660_PoC

CVE-2013-4660—11 jun 2026

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

43RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2026-10520

CVE-2026-10520CRITICALbajo ataque11 jun 2026

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

100RIESGO

abrir ↗

GitHub PoC

xxconi/CVE-2025-6254

CVE-2025-6254CRITICAL11 jun 2026

Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation

48RIESGO

abrir ↗

GitHub PoC

Cyber-DarkNay/CVE-2026-7458

CVE-2026-7458CRITICAL11 jun 2026

User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint

48RIESGO

abrir ↗

GitHub PoC

CVE-2017-9841 is a Remote Code Execution (RCE) vulnerability in the PHPUnit library affecting versions prior to 5.6.3 and 6.x prior to 6.4.2.

CVE-2017-9841CRITICALbajo ataque11 jun 2026

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-10520 and CVE-2026-10523

CVE-2026-10520CRITICALbajo ataque11 jun 2026

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

100RIESGO

abrir ↗

GitHub PoC

kaleth4/CVE-2021-4045

CVE-2021-4045CRITICAL11 jun 2026

TP-LINK Tapo C200 remote code execution vulnerability

70RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-11645

CVE-2026-11645HIGHbajo ataque11 jun 2026

Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitra

71RIESGO

abrir ↗

GitHub PoC

This repository contains a lab validation report and detection artefacts for DirtyFrag CVE-2026-43284, a Linux local privilege escalation issue related to the XFRM/ESP page-cache write path. The focus is on auditd telemetry, event correlation, and SOC-oriented detection logic.

CVE-2026-43284HIGH11 jun 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC★ 1

Lab + writeup for CVE-2026-28699: Gitea OAuth2 scope enforcement bypass via HTTP Basic auth

CVE-2026-28699HIGH11 jun 2026

Gitea Basic Auth bypasses OAuth2 access token scopes

41RIESGO

abrir ↗

GitHub PoC★ 1

PoC didático em Python 3 para a CVE-2019-9053, uma SQL Injection time-based blind no CMS Made Simple <= 2.2.9. Esta versão foi adaptada para uso em CTF/laboratório, com prefixos pré-configurados para reduzir o tempo de extração e mensagens explicativas em português.

CVE-2019-9053—11 jun 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RIESGO

abrir ↗

GitHub PoC

Cyber-DarkNay/CVE-2026-23550

CVE-2026-23550CRITICAL11 jun 2026

WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability

68RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2026-36213 | Local Privilege Escalation in MEmu Android Emulator 9.2.7.0 via Insecure Service Binary Permissions | Patched in 9.3.2

CVE-2026-36213HIGH11 jun 2026

An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.e

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-43284HIGH11 jun 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-10795 – UpdraftPlus Authentication Bypass

CVE-2026-10795HIGH11 jun 2026

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-10795 The UpdraftPlus POC

CVE-2026-10795HIGH11 jun 2026

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

41RIESGO

abrir ↗

GitHub PoC

Lab + writeup for CVE-2026-44166: PocketBase OAuth2 account pre-hijacking via unvalidated createData.email

CVE-2026-44166MEDIUM11 jun 2026

Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-5027 - Draft

CVE-2026-5027HIGH11 jun 2026

Langflow - Path Traversal Arbitrary File Write via upload_user_file

56RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.