Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.853exploits catalogados

39.383CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.269 exploits

GitHub PoC★ 1

Modern Events Calendar Lite <= 7.33.0 — Unauthenticated SQL Injection

CVE-2026-11349HIGH05 jun 2026

Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more

41RIESGO

abrir ↗

GitHub PoC

t1ckprivate/CVE-2026-43284-Dirty-Frag

CVE-2026-43284HIGH05 jun 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC

react CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware05 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

yurahshell/CVE-2026-41940

CVE-2026-41940CRITICALbajo ataqueransomware05 jun 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC

t1ckprivate/CVE-2026-31431-Copy-Fail

CVE-2026-31431HIGHbajo ataque05 jun 2026

crypto: algif_aead - Revert to operating out-of-place

86RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2026-49975 HTTP/2 Stream Amplification — Docker PoC with Web Console

CVE-2026-49975HIGH05 jun 2026

Apache HTTP Server: mod_http2 denial of service

41RIESGO

abrir ↗

GitHub PoC

Dependency-free interactive Python exploit for the vsftpd 2.3.4 backdoor (CVE-2011-2523).

CVE-2011-2523—05 jun 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

abrir ↗

GitHub PoC

cve-2026-23744 python exploit

CVE-2026-23744CRITICAL05 jun 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC

Hands-on lab for CVE-2026-40072 — SSRF vulnerability in web3.py via CCIP Read (EIP-3668)

CVE-2026-40072LOW05 jun 2026

web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling

28RIESGO

abrir ↗

GitHub PoC

Popcorn HTB write-up covering advanced directory fuzzing, file upload bypass via magic numbers/extension spoofing using Burp Suite, and privilege escalation via CVE-2010-0832 (PAM MOTD File Tampering).

CVE-2010-0832—05 jun 2026

pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before

23RIESGO

abrir ↗

GitHub PoC

yurahshell/CVE-2025-49132

CVE-2025-49132CRITICAL05 jun 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RIESGO

abrir ↗

GitHub PoC★ 66

Safely detect whether a UniFi OS Server is vulnerable to CVE-2026-34908

CVE-2026-34908CRITICALbajo ataque05 jun 2026

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS de

98RIESGO

abrir ↗

GitHub PoC

react2shell - CVE-2025-55182 (Next.js: CVE-2025-66478) - Unauthenticated RCE in React Server Components (Flight Protocol) - PoC Exploit

CVE-2025-55182CRITICALbajo ataqueransomware05 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-23631-Draft

CVE-2026-23631MEDIUM04 jun 2026

redis-server Lua use-after-free may allow remote code execution

33RIESGO

abrir ↗

GitHub PoC

Dhananjayasj/CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698CRITICAL04 jun 2026

NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection

85RIESGO

abrir ↗

GitHub PoC

Improved Metasploit module for CVE-2013-6117 (Dahua DVR authentication bypass)

CVE-2013-6117—04 jun 2026

Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive informatio

50RIESGO

abrir ↗

GitHub PoC

Piotnet Forms Pro <= 2.1.40 - Unauthenticated Arbitrary File Upload → RCE

CVE-2026-4883CRITICAL04 jun 2026

Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload

48RIESGO

abrir ↗

GitHub PoC★ 10

strivepan/ActiveMQ-cve-2026-42588-scanner-gui

CVE-2026-42588HIGH04 jun 2026

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

41RIESGO

abrir ↗

GitHub PoC

0-Click RCE Android Adb TLS Wireless Debugging

CVE-2026-0073HIGH04 jun 2026

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic err

41RIESGO

abrir ↗

GitHub PoC★ 1

horrister/solarwinds-sunburst-cve-2020-10148

CVE-2020-10148CRITICALbajo ataque04 jun 2026

SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

100RIESGO

abrir ↗

GitHub PoC★ 13

Attack surface in the real-world environment of CVE-2026-41096

CVE-2026-41096CRITICAL04 jun 2026

Windows DNS Client Remote Code Execution Vulnerability

48RIESGO

abrir ↗

GitHub PoC

Safe read-only version checker + Sigma rule for Redis CVE-2026-23479 (authenticated use-after-free → RCE). Find exposed instances, patch left-of-boom. By DugganUSA.

CVE-2026-23479HIGH04 jun 2026

redis-server use-after-free in unblock client flow may allow remote code execution

41RIESGO

abrir ↗

GitHub PoC

rootdirective-sec/CVE-2026-34234-Lab

CVE-2026-34234CRITICAL04 jun 2026

CtrlPanel: Unauthenticated RCE using installer script

63RIESGO

abrir ↗

GitHub PoC

CVE-2026-45247 - Draft

CVE-2026-45247CRITICALbajo ataque04 jun 2026

Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

78RIESGO

abrir ↗

GitHub PoC

CVE-2026-35904 / CVE-2026-35905 / CVE-2026-35906 — Unauth RCE, Hardcoded Root Creds & Telnet Enable in T3 Technology CPE

CVE-2026-35904CRITICAL04 jun 2026

Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, an

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-50142 — Heap allocation vulnerability in libheif HEIF sequence parser

CVE-2026-50142HIGH04 jun 2026

libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)

41RIESGO

abrir ↗

GitHub PoC★ 1

horrister/log4shell-cve-2021-44228

CVE-2021-44228CRITICALbajo ataqueransomware04 jun 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

HTB Facts is a Easy Linux box featuring Camaleon CMS and MinIO. Gain admin access via open registration and a mass assignment vulnerability, then extract MinIO credentials from admin settings. Use CVE-2024-46987 path traversal to steal an SSH private key, crack its passphrase, and escalate to root by abusing sudo permissions on facter via GTFOBins.

CVE-2024-46987HIGH04 jun 2026

Arbitrary path traversal in Camaleon CMS

61RIESGO

abrir ↗

GitHub PoC★ 2

Proof of Concept (PoC) exploit for CVE-2026-6815: Authenticated Path Traversal & Arbitrary File Write in Casdoor (< 3.54.1) leading to RCE/DoS.

CVE-2026-6815MEDIUM04 jun 2026

CVE-2026-6815

33RIESGO

abrir ↗

GitHub PoC★ 29

HTTP/2 Bomb PoC — CVE-2026-49975 (HPACK indexed reference bomb + flow-control stall)

CVE-2026-49975HIGH04 jun 2026

Apache HTTP Server: mod_http2 denial of service

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.