Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC

Reproducer for CVE-2026-78329 (Apache Camel camel-undertow header filter strategy not applied, websocket.* injection) — Camel Spring Boot

CVE-2026-78329CRITICAL24 ago 2026

Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

48RIESGO

GitHub PoC

Patch: SSRF leading to RCE (Microsoft Exchange Server)

CVE-2026-15502MEDIUM24 ago 2026

AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection

33RIESGO

GitHub PoC

CVE-2025-48595 Android Framework Integer Overflow PoC - 优化版

CVE-2025-48595HIGHbajo ataque24 ago 2026

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to

71RIESGO

GitHub PoC

Patch: OGNL injection (Apache Struts)

CVE-2026-10520CRITICALbajo ataque24 ago 2026

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

100RIESGO

GitHub PoC

CVE-2026-73570 PoC

CVE-2026-73570HIGHbajo ataque24 ago 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALbajo ataque24 ago 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-18963CRITICAL24 ago 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

GitHub PoC

Reproducer for CVE-2026-59230 (Apache Camel camel-mail MimeMultipart headersInline header injection) — Camel Spring Boot + Camel Quarkus

CVE-2026-59230MEDIUM24 ago 2026

Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

33RIESGO

GitHub PoC

Patch: Authentication bypass (VMware vCenter)

CVE-2026-11553HIGH24 ago 2026

Tenda HG7/HG9/HG10 formPPPEdit stack-based overflow

41RIESGO

GitHub PoC★ 1

Firefox content-to-parent IPDL privilege escalation (N-day, bug 2054416): forged PDocumentChannel with RemoteTypeOverride -> privilegedabout process placement, via mojo-port send-path injection from a compromised content process

CVE-2026-74939HIGH24 ago 2026

Privilege escalation in the DOM: Navigation component

41RIESGO

GitHub PoC

SIMPLE EXPOIT FOR CVE-2025-55182 FOR RCE , COMMAND INJECTIONS AND OTHER VULNERABILITIES

CVE-2025-55182CRITICALbajo ataqueransomware24 ago 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC

minh3102011/CVE-2026-18963_analyst

CVE-2026-18963CRITICAL24 ago 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

GitHub PoC★ 2

CVE-2026-77806漏洞检测代码

CVE-2026-77806CRITICAL24 ago 2026

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August

63RIESGO

GitHub PoC

Patch: Privilege escalation via web UI (Cisco IOS XE)

CVE-2026-19843HIGH24 ago 2026

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

41RIESGO

GitHub PoC

xAL6/cve-2026-64638-banner-poc

CVE-2026-64638HIGH24 ago 2026

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malici

56RIESGO

VulnCheck XDB

initial-access

CVE-2026-9198CRITICALbajo ataque24 ago 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RIESGO

GitHub PoC

h00die/POC-CVE-2026-19626

CVE-2026-19626CRITICAL24 ago 2026

Remote Code Execution

63RIESGO

GitHub PoC

h00die/POC-CVE-2026-19679

CVE-2026-19679HIGH24 ago 2026

Improper Input Validation

41RIESGO

GitHub PoC

Reproducer for CVE-2026-66907 (Apache Camel camel-google-storage downloadFileName path traversal) — Camel Spring Boot + Camel Quarkus

CVE-2026-66907HIGH24 ago 2026

Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

41RIESGO

GitHub PoC

Reproducer for CVE-2026-66908 (Apache Camel camel-platform-http-main JWT iss/aud not validated) — standalone camel-main

CVE-2026-66908HIGH24 ago 2026

Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

41RIESGO

GitHub PoC

Password-Protected Category Bypass via JSON Format in JoomGallery

CVE-2026-66916MEDIUM23 ago 2026

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0

33RIESGO

GitHub PoC

h00die/POC-CVE-2026-19681

CVE-2026-19681CRITICAL23 ago 2026

Command Injection

63RIESGO

GitHub PoC

CVSS v3.1 assessment of CVE-2009-0658 (Adobe Acrobat Buffer Overflow), including Base, Temporal, and Environmental scoring and remediation recommendations.

CVE-2009-0658—23 ago 2026

Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitra

60RIESGO

GitHub PoC★ 1

PoC exploit chain for CVE-2026-15718: SpiderMonkey wasm baseline compiler array.fill missing-sync -> invalid pointer -> addrOf/fakeobj -> arbitrary R/W -> RCE

CVE-2026-15718MEDIUM23 ago 2026

Invalid pointer in the JavaScript: WebAssembly component

33RIESGO

GitHub PoC

Exploiting the vsftpd 2.3.4 backdoor (CVE-2011-2523) on Metasploitable2 — a hands-on pentesting lab writeup covering recon, exploitation, and remediation.

CVE-2011-2523—23 ago 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

GitHub PoC

chessalekin/cve-2026-9198_exploit

CVE-2026-9198CRITICALbajo ataque23 ago 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RIESGO

GitHub PoC

Professional PHPMyAdmin 5.0.0 SQL Injection (CVE-2020-5504) exploitation framework with automated database enumeration, table extraction, and data dumping capabilities. Features blind injection, proxy support, JSON output, and comprehensive error handling for authorized penetration testing and security research. Author: Sudeepa Wanigarathna

CVE-2020-5504—23 ago 2026

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could

28RIESGO

GitHub PoC★ 4

Reproducible lab for CVE-2026-10053 (GitLab npm package-registry path traversal -> arbitrary file write as git). Vulnerable 19.2.1 vs patched 19.2.2, deterministic oracle.

CVE-2026-10053HIGH23 ago 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

41RIESGO

GitHub PoC

IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery

CVE-2026-66917HIGH23 ago 2026

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0

41RIESGO

GitHub PoC

Legendile7/CVE-2026-78122-POC

CVE-2026-78122HIGH23 ago 2026

docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.