Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC

Aimy Captcha-Less Form Guard Joomla Component PHP Object Injection RCE. clfgd XOR keystream recovery + unserialize(). CVSS 10.0 | CWE-502 | aimy_captcha-less_form_guard < 20.1

CVE-2026-65883CRITICAL30 jul 2026

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

48RIESGO

GitHub PoC★ 1

Gitea diffpatch RCE

CVE-2026-60004CRITICALbajo ataque30 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

98RIESGO

GitHub PoC★ 6

CVE-2026-60004

CVE-2026-60004CRITICALbajo ataque30 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

98RIESGO

GitHub PoC

Hands-on exploit lab for CVE-2024-28000 — unauthenticated privilege escalation in LiteSpeed Cache (WordPress plugin, <=6.3.0.1). Spins up a vulnerable environment with Docker and includes a Go-based brute-forcer that cracks the weak mt_rand hash to create an administrator account.

CVE-2024-28000CRITICAL30 jul 2026

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

75RIESGO

GitHub PoC★ 1

DJ-Classifieds Joomla Component Unauthenticated File Upload RCE. 3-string filter bypass via PHP short tags. CVSS 10.0 | CWE-434 | com_djclassifieds < 3.11.2

CVE-2026-61424CRITICAL30 jul 2026

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

48RIESGO

GitHub PoC

Security Advisory: Stored Cross-Site Scripting Via Agent Messages Leading To Session Token Theft (openclaw-dashboard)

CVE-2026-66421HIGH30 jul 2026

OpenClaw Dashboard Stored XSS via lastMessage Session Field

41RIESGO

VulnCheck XDB

initial-access

CVE-2026-60004CRITICALbajo ataque30 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

98RIESGO

GitHub PoC★ 1

Fastjson RCE

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

VulnCheck XDB

info-leak

CVE-2021-41773HIGHbajo ataqueransomware29 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-66066CRITICAL29 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

75RIESGO

GitHub PoC★ 5

CVE-2026-60004

CVE-2026-60004CRITICALbajo ataque29 jul 2026

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

98RIESGO

GitHub PoC★ 1

CVE-2026-43499 exploit adapter for MT6985 MediaTek Dimensity 9300 (vivo PD2241)

CVE-2026-43499HIGH29 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

VulnCheck XDB

initial-access

CVE-2024-36104CRITICAL29 jul 2026

Apache OFBiz: Path traversal leading to a RCE

85RIESGO

GitHub PoC★ 16

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE. Split-controller upload bypass. CVSS 9.8 | CWE-434 | com_rsfiles < 1.17.12

CVE-2026-57827CRITICAL29 jul 2026

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

68RIESGO

GitHub PoC

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code

CVE-2026-61511CRITICAL29 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

63RIESGO

GitHub PoC★ 1

Gitea Docker Image Authentication Bypass

CVE-2026-20896CRITICAL29 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RIESGO

Metasploit300

Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution

CVE-2025-24293CRITICAL29 jul 2026

# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of pote

63RIESGO

GitHub PoC★ 1

Pravin761/CVE-2026-54107

CVE-2026-54107HIGH29 jul 2026

Windows Win32k Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC★ 23

PoC for CVE-2026-66066 in Ruby on Rails

CVE-2026-66066CRITICAL29 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

75RIESGO

Metasploit300

Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution

CVE-2026-66066CRITICAL29 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

75RIESGO

GitHub PoC

webshellseo8/CVE-2026-61511-POC

CVE-2026-61511CRITICAL29 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

63RIESGO

GitHub PoC

Public technical advisory and reproduction evidence for CVE-2026-52134 affecting GOOSE replay handling in libiec61850 v1.6.

CVE-2026-52134CRITICAL29 jul 2026

An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass au

48RIESGO

GitHub PoC

Tracking OVSwrap (CVE-2026-64531), the Open vSwitch datapath netlink overflow

CVE-2026-64531HIGH29 jul 2026

net: openvswitch: reject oversized nested action attrs

41RIESGO

GitHub PoC

Agent skill that audits a Rails codebase for CVE-2026-66066 (KindaRails2Shell) — Active Storage + libvips arbitrary file read / RCE, checking Rails and libvips versions and block-untrusted mitigations

CVE-2026-66066CRITICAL29 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

75RIESGO

GitHub PoC

webshellseo8/CVE-2026-50522-Proof-of-Concept

CVE-2026-50522CRITICALbajo ataque29 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

78RIESGO

GitHub PoC

webshellseo8/CVE-2026-57811-Proof-of-Concept

CVE-2026-57811CRITICAL29 jul 2026

WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability

48RIESGO

GitHub PoC

CamilleGR/CVE-2026-73292

CVE-2026-73292HIGH29 jul 2026

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

41RIESGO

GitHub PoC★ 5

CVE-2026-58025 — MediaWiki Deserialization RCE via Log Entry Import. LogEntryBase::extractParams() unserialize() user-controlled log_params. CVSS 9.8 | CWE-502 | MediaWiki < 1.43.9, < 1.44.6, < 1.45.4, < 1.46.0

CVE-2026-58025MEDIUM29 jul 2026

Remote Code Execution via Unsafe Deserialization in LogItem Import

33RIESGO

GitHub PoC★ 4

CVE-2026-49176 WalletService LPE — standalone PoC + Cobalt Strike BOF (SYSTEM command on interactive session)

CVE-2026-49176HIGH29 jul 2026

Windows WalletService Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC★ 6

CVE-2026-61511 – vBulletin Pre-Auth RCE (CVSS 9.8). Vuln 5.x/6.x (unpatched). Multi-exploit via Endpoint Pool, AJAX, PHPFuck WAF bypass. Full toolkit: reverse shell, proxy, persistence, webshell, database operations, firewall control, log management, mass scanning. 2 versions: multi-exploit & safe-check. Python 3.8+ Use Ethically, Stay Legal.

CVE-2026-61511CRITICAL29 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

63RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.