Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC

Detailed technical analysis of CVE-2026-43284 (Dirty Frag) local privilege escalation flaw in the Linux kernel.

CVE-2026-43284HIGH24 sep 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC

Write-up машины Nexus (HTB). Цепочка атак: утечка данных в Git history → Krayin CRM RCE (CVE-2026-38526) → повышение привилегий через Git internals и SUID binary. Подробный разбор векторов атак с иллюстрациями.

CVE-2026-38526CRITICAL24 sep 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

abrir ↗

GitHub PoC★ 14

a23bc/op13-cve-2026-64560

CVE-2026-64560HIGH24 sep 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-12227CRITICAL24 sep 2026

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

63RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2026-72001 — Pangolin < 1.22.0 cross-organization resource authentication bypass via the share-link access-token endpoint (CWE-639, CVSS 8.1).

CVE-2026-72001HIGH24 sep 2026

Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

41RIESGO

abrir ↗

GitHub PoC★ 1

yulisec/CVE-2025-7771

CVE-2025-7771HIGH24 sep 2026

Code Execution / Escalation of Privileges in ThrottleStop

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-12227 - Visual Composer <= 45.16.0 unauthenticated LFI via vcv-template (CVSS 9.8): Docker validation lab, safe-oracle PoC, nuclei template. Root cause: validate-then-mutate on the theme: prefix. Verified: vendor fix never landed - fires through 45.16.3 on WP <= 7.1.1; masked by WP 7.1.2 core gate.

CVE-2026-12227CRITICAL24 sep 2026

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

63RIESGO

abrir ↗

GitHub PoC

CVE-2026-94609: Writeup and POC

CVE-2026-94609HIGH24 sep 2026

authentik: Privilege Escalation to Superuser via Group Hierarchy

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-12227 (CVSS 9.8): WordPress Visual Composer Website Builder ≤45.16.0 — unauthenticated local file inclusion via vcv-template. Educational PoC only.

CVE-2026-12227CRITICAL24 sep 2026

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

63RIESGO

abrir ↗

Exploit-DB

MikroTrick_ 7.24_ 7.24.2_ 7.0.0_ 7.23.4_ 6.0.0_ 6.49.21 - RCE

CVE-2026-86060CRITICALbajo ataqueremotemultiple24 sep 2026

SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

78RIESGO

abrir ↗

GitHub PoC

A WordPress plugin exposing an MCP server over the REST API, with the security model as the point -- closes the CVE-2026-15015 OAuth-bypass shape by never having that surface at all.

CVE-2026-15015CRITICAL24 sep 2026

MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint

63RIESGO

abrir ↗

GitHub PoC

UnrealIRCd 3.2.8.1 backdoor exploit — reverse shell via AB; trigger, built from scratch in Python using raw sockets. No Metasploit.

CVE-2010-2075—24 sep 2026

UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally

60RIESGO

abrir ↗

GitHub PoC

Detailed technical analysis of CVE-2026-43284 (Dirty Frag) local privilege escalation flaw in the Linux kernel.

CVE-2026-43284HIGH24 sep 2026

xfrm: esp: avoid in-place decrypt on shared skb frags

78RIESGO

abrir ↗

GitHub PoC★ 1

yulisec/CVE-2026-90817

CVE-2026-90817CRITICAL24 sep 2026

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce

63RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2023-49070—24 sep 2026

Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present

60RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-60137MEDIUMbajo ataque24 sep 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-87902HIGHbajo ataque24 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-94127CRITICALbajo ataque24 sep 2026

BIG-IP APM OAuth vulnerability

83RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-63030CRITICALbajo ataque24 sep 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

GitHub PoC

CVE-2026-63030 + CVE-2026-60137 WordPress Core pre-auth RCE mass exploit

CVE-2026-63030CRITICALbajo ataque24 sep 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

VulnCheck XDB

local

CVE-2025-7771HIGH24 sep 2026

Code Execution / Escalation of Privileges in ThrottleStop

41RIESGO

abrir ↗

GitHub PoC

Ninja Forms unauth stored XSS POC

CVE-2026-94504HIGH24 sep 2026

Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting

21RIESGO

abrir ↗

GitHub PoC★ 15

watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127

CVE-2026-94127CRITICALbajo ataque24 sep 2026

BIG-IP APM OAuth vulnerability

83RIESGO

abrir ↗

GitHub PoC

zyphorixofficialmain-lab/cve-2026-87902

CVE-2026-87902HIGHbajo ataque24 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

abrir ↗

GitHub PoC★ 1

This repository contains the exploit for CVE-2026-16764.

CVE-2026-16764MEDIUM24 sep 2026

OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

33RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-87902 detector. WordPress get_page_template LFI class. Detect-only. Authorized lab.

CVE-2026-87902HIGHbajo ataque23 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

abrir ↗

GitHub PoC★ 15

CVE-2026-87902 – WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7–7.1.1. | 2 tools: Full Exploit (LFI, PEAR RCE, admin create, webshell, reverse shell, loot, mass scan, stealth) & SafeChecker (version detect, risk audit, JSON report). Use Ethically & Authorized Enviorement, Stay Legal <3

CVE-2026-87902HIGHbajo ataque23 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-87902HIGHbajo ataque23 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2021-41773HIGHbajo ataqueransomware23 sep 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-86218CRITICALbajo ataque23 sep 2026

pre-authentication remote code execution

98RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.