Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.554exploits catalogados

39.165CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.153 exploits

GitHub PoC

Sanitized report summary and local PoC for CVE-2026-103441

CVE-2026-103441HIGH30 sep 2026

Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-76570 PoC (PoCbit) — Joomla JCTables (com_jctables) <1.21.1: unauth SQL read/write via front-end JSON API getdatarow/getrow (CVSS 4.0 10.0 AT:N). check + exploit + mass. https://www.cve.org/CVERecord?id=CVE-2026-76570

CVE-2026-76570CRITICAL30 sep 2026

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

48RIESGO

abrir ↗

GitHub PoC

Sanitized report summary and local PoC for CVE-2026-103442

CVE-2026-103442HIGH30 sep 2026

MergeAccount PHP object injection via session-key substitution

41RIESGO

abrir ↗

GitHub PoC★ 1

Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC

CVE-2026-94545MEDIUM30 sep 2026

Satori-generated SVG has improper escaping

33RIESGO

abrir ↗

GitHub PoC

Sanitized report summary and local PoC for CVE-2026-103446

CVE-2026-103446HIGH30 sep 2026

WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).

CVE-2026-12227CRITICAL30 sep 2026

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

63RIESGO

abrir ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96874.

CVE-2026-96874LOW29 sep 2026

Stored XSS in Cargo Drilldown tab names

28RIESGO

abrir ↗

GitHub PoC

kiyingiericmark-wq/CVE-2020-24186

CVE-2020-24186CRITICAL29 sep 2026

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

85RIESGO

abrir ↗

GitHub PoC

A detection/hunting script for compromise related to CVE-2026-88771

CVE-2026-88771CRITICALbajo ataque29 sep 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

78RIESGO

abrir ↗

GitHub PoC

Sanitized CirrusSearch report and patch verification notes for CVE-2026-96873.

CVE-2026-96873MEDIUM29 sep 2026

Reflected XSS in CirrusSearch debug explain output

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-85520 PoC (PoCbit) — PrestaShop MyPresta gmfeed ≤2.3.9 unauthenticated arbitrary file write via feed.php (Save to file URL) → RCE. check + exploit + mass bulk (--list -j). https://pocbit.org/pocs/cve-2026-85520

CVE-2026-85520CRITICAL29 sep 2026

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

48RIESGO

abrir ↗

GitHub PoC

container escape POCs for CVE-2026-80521 and CVE-2026-52910

CVE-2026-80521HIGH29 sep 2026

af_unix: Unlink scc_entry in unix_del_edge().

41RIESGO

abrir ↗

GitHub PoC★ 1

Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.

CVE-2026-63030CRITICALbajo ataque29 sep 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96875.

CVE-2026-96875MEDIUM29 sep 2026

Reflected XSS in Cargo Drilldown hierarchy filters

33RIESGO

abrir ↗

GitHub PoC

Published Epson EH-TW5350 CVE · Hard-coded credentials · B-BEAM-BOB team

CVE-2021-43717CRITICAL29 sep 2026

An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection

48RIESGO

abrir ↗

GitHub PoC

Published Epson EH-TW5350 CVE · Web Control authentication bypass · B-BEAM-BOB team

CVE-2021-43718MEDIUM29 sep 2026

An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malici

33RIESGO

abrir ↗

GitHub PoC

Published Epson EH-TW5350 CVE · Firmware update verification bypass · B-BEAM-BOB team

CVE-2021-43716CRITICAL29 sep 2026

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-101110 PoC: OrdaSoft Joomla Book Library (Free) <=6.4.6 unauth SQLi — field/direction ORDER BY, session prime + `-- xselect` blacklist bypass (com_booklibrary). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101110

CVE-2026-101110CRITICAL29 sep 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6

48RIESGO

abrir ↗

GitHub PoC★ 1

PoC / Exploit for CVE-2025-32463(sudo LPE)

CVE-2025-32463CRITICALbajo ataque29 sep 2026

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

abrir ↗

GitHub PoC★ 10

Docker lab for validating CVE-2026-84383 in libheif through Discourse

CVE-2026-84383CRITICAL29 sep 2026

libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware endpoint probe, lab-safe upload test. https://pocbit.org/pocs/cve-2026-8065

CVE-2026-8065CRITICAL29 sep 2026

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions all

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-100752 PoC: OrdaSoft Joomla Real Estate Manager (Free) <=6.7.8 unauth SQLi via order_field ORDER BY (com_realestatemanager). Colored check + mass exploit, version fingerprint, PoCbit https://pocbit.org/pocs/cve-2026-100752

CVE-2026-100752CRITICAL29 sep 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

48RIESGO

abrir ↗

GitHub PoC

Sanitized Cargo report and patch verification notes for CVE-2026-96876.

CVE-2026-96876MEDIUM29 sep 2026

Anonymous reflected XSS in CargoExport invalid-alias errors

33RIESGO

abrir ↗

GitHub PoC★ 51

Next.js RCE

CVE-2026-94545MEDIUM29 sep 2026

Satori-generated SVG has improper escaping

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894

CVE-2026-101894CRITICAL29 sep 2026

@xhmikosr/decompress: Path traversal via symlink chain

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-101108 PoC: OrdaSoft Joomla Vehicle Manager (Free) <=6.5.7 unauth SQLi — order_field/order_direction unquoted ORDER BY (com_vehiclemanager). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101108

CVE-2026-101108CRITICAL29 sep 2026

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

48RIESGO

abrir ↗

GitHub PoC★ 5

XWP_RCE — CVE-2026-87902 Hacker Console

CVE-2026-87902HIGHbajo ataque29 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RIESGO

abrir ↗

GitHub PoC

CVE-2025-24813 Apache Tomcat 11 1-day vulnerability research lab

CVE-2025-24813CRITICALbajo ataque29 sep 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RIESGO

abrir ↗

GitHub PoC

https://vuldb.com/cve/CVE-2026-102261

CVE-2026-102261MEDIUM29 sep 2026

owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization

33RIESGO

abrir ↗

GitHub PoC

Sanitized WikiLambda report and patch verification notes for CVE-2026-96872.

CVE-2026-96872LOW29 sep 2026

WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

28RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.