Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC

CVE-2026-93958 PoC: D-Link R95 BE9500 DHMAPI SetTimeSettings NTPServer authenticated root command injection. DHMAPI login, RCE verify, mass bulk exploit mode, colored CLI. https://pocbit.org/pocs/cve-2026-93958

CVE-2026-93958CRITICAL28 sep 2026

D-Link R95 DHMAPI ssi system os command injection

48RIESGO

GitHub PoC★ 1

CVE-2026-87902 — WordPress Core LFI → RCE

CVE-2026-87902HIGHbajo ataque28 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

GitHub PoC

CVE-2026-82384 PoC: Apache Roller 6.1.5 unauthenticated XML-RPC ex:serializable Java deserialization (pre-auth RCE). Check, ysoserial exploit, mass bulk scanning, colored CLI. PoCbit — https://pocbit.org/pocs/cve-2026-82384

CVE-2026-82384CRITICAL28 sep 2026

Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

48RIESGO

GitHub PoC★ 178

🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.

CVE-2026-75604CRITICAL28 sep 2026

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

63RIESGO

GitHub PoC

Hasyros/CVE-2026-101161-dos-wp-ultimate-review-shortcode

CVE-2026-101161HIGH28 sep 2026

WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode

41RIESGO

GitHub PoC★ 23

ZeroDayEvil/CVE-2026-62911

CVE-2026-62911HIGH28 sep 2026

Microsoft Exchange Server Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC★ 1

jvidhan/cve-2026-28912

CVE-2026-28912HIGH28 sep 2026

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.7

41RIESGO

GitHub PoC

Proof-of-Concept for CVE-2026-18110

CVE-2026-18110HIGH28 sep 2026

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username

56RIESGO

GitHub PoC

Hasyros/CVE-2026-101162-xss-wp-ultimate-review

CVE-2026-101162MEDIUM28 sep 2026

WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings

33RIESGO

VulnCheck XDB

initial-access

CVE-2026-82901CRITICAL28 sep 2026

Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

63RIESGO

GitHub PoC★ 22

ZeroDayEvil/CVE-2026-24061

CVE-2026-24061CRITICALbajo ataque28 sep 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC★ 26

ZeroDayEvil/CVE-2026-54121

CVE-2026-54121HIGH28 sep 2026

Active Directory Certificate Services Elevation of Privilege Vulnerability

41RIESGO

VulnCheck XDB

initial-access

CVE-2026-100382CRITICAL28 sep 2026

Unauthenticated remote code execution through wikitext in ExternalData

48RIESGO

GitHub PoC

CVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)

CVE-2026-88772CRITICALbajo ataque28 sep 2026

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

100RIESGO

GitHub PoC

CVE-2026-85984 PoC: WordPress miniOrange OTP ≤5.5.5 unauth admin bypass (mo_wp_login_intent=otp + empty password). Check/exploit, user enum, colored CLI. https://pocbit.org/pocs/cve-2026-85984

CVE-2026-85984CRITICAL28 sep 2026

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter

48RIESGO

GitHub PoC★ 3

CVE-2026-87902 — WordPress Core LFI → RCE by Hackfut

CVE-2026-87902HIGHbajo ataque28 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

GitHub PoC

Hands-on cybersecurity and CTF labs covering port reconnaissance, CMS stack discovery, VulnCMS, CVE-2026-58225, shell-to-root paths, Python, sudo, user switching, passwords, and post-exploitation.

CVE-2026-58225LOW28 sep 2026

SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

28RIESGO

GitHub PoC★ 8

One-click temporary KernelSU root (late-load) for Samsung Galaxy via DirtyFrag (CVE-2026-43284). No Shizuku/PC/ADB.

CVE-2026-43284HIGH28 sep 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

GitHub PoC

CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus.

CVE-2026-38526CRITICAL28 sep 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

VulnCheck XDB

initial-access

CVE-2026-87902HIGHbajo ataque28 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

GitHub PoC★ 1

CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM <= 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Python PoC for security researchers, CTF players and bug bounty hunters. Tested on HTB Nexus.

CVE-2026-38526CRITICAL28 sep 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC★ 28

ZeroDayEvil/CVE-2026-41940-PoC

CVE-2026-41940CRITICALbajo ataqueransomware28 sep 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

VulnCheck XDB

info-leak

CVE-2021-43798HIGHbajo ataque28 sep 2026

Grafana path traversal

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-61500CRITICAL28 sep 2026

Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key

48RIESGO

GitHub PoC★ 22

Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778), CTX697174, CTX697191 (SAML RCE) and CTX697263 php2shell (fixed in 14.1-73.49 / 13.1-64.32): build, CVE preconditions, SAML, mgmt exposure, MFA, upgrade risks + IoC sweep with every public IoC (webshells, implants, 133 attacker IPs).

CVE-2026-88771CRITICALbajo ataque28 sep 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-18143CRITICAL28 sep 2026

Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler

63RIESGO

VulnCheck XDB

initial-access

CVE-2026-18143CRITICAL28 sep 2026

Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler

63RIESGO

GitHub PoC

Thesis scenario test (research only): Scenario C: EPSS-BLOCK path - node-serialize@0.0.4 CVE-2017-5941

CVE-2017-5941—28 sep 2026

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu

35RIESGO

VulnCheck XDB

initial-access

CVE-2026-48356CRITICAL28 sep 2026

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

60RIESGO

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-88771CRITICALbajo ataque28 sep 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

100RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.