Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.554exploits catalogados

39.165CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.153 exploits

GitHub PoC

griisemine/cve-2026-87902-detection

CVE-2026-87902HIGHbajo ataque22 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RIESGO

abrir ↗

GitHub PoC★ 35

CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)

CVE-2026-87902HIGHbajo ataque22 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RIESGO

abrir ↗

GitHub PoC★ 9

Unauthenticated RCE on Wordpress

CVE-2026-87902HIGHbajo ataque22 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RIESGO

abrir ↗

GitHub PoC

Simple Checks to look for indicators of compromise

CVE-2026-93616CRITICALbajo ataque22 sep 2026

Directory Traversal and File upload allows execution of arbitrary script on the Management Server

98RIESGO

abrir ↗

GitHub PoC

pwnVader/CVE-2026-87902-PoC-pwnVader

CVE-2026-87902HIGHbajo ataque22 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RIESGO

abrir ↗

GitHub PoC

CVE-2026-61628 - nginx-ignition - High 8.1 - Unauthenticated Privilege Escalation (Administrator Account Creation)

CVE-2026-61628HIGH22 sep 2026

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

41RIESGO

abrir ↗

GitHub PoC

Laboratório de pentest em rede isolada: enumeração com nmap/nikto e exploração manual do Metasploitable2 (backdoor vsFTPd CVE-2011-2523, bindshell) com relatório técnico completo.

CVE-2011-2523—22 sep 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

abrir ↗

GitHub PoC★ 1

HPLIP < 3.26.6 — Full admin takeover via PAPPL web interface (no auth). Related to CVE-2026-91097 through CVE-2026-91106 (CVSS 9.3)

CVE-2026-91097HIGH22 sep 2026

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-68376 - Ubuntu Kernel 7.0.0-30

CVE-2026-68376HIGH22 sep 2026

sctp: fix auth_hmacs array size in struct sctp_cookie

41RIESGO

abrir ↗

GitHub PoC★ 1

nmlz/CVE-2026-62878

CVE-2026-62878CRITICAL22 sep 2026

Windows DNS Server Remote Code Execution Vulnerability

48RIESGO

abrir ↗

GitHub PoC★ 39

PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab

CVE-2026-87902HIGHbajo ataque22 sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RIESGO

abrir ↗

GitHub PoC

From-scratch exploit development in Python. No Metasploit. No frameworks. Raw socket-level implementation of real CVEs against authorized lab targets.

CVE-2011-2523—22 sep 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

abrir ↗

GitHub PoC

CVE-2026-93485

CVE-2026-93485HIGH22 sep 2026

WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability

41RIESGO

abrir ↗

GitHub PoC★ 1

WordPress Give Tributes CVE-2026-19658: Python 3 checker, FOFA helper, legacy Give form exploit path (CWE-502, CVSS 9.8).

CVE-2026-19658CRITICAL22 sep 2026

Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter

48RIESGO

abrir ↗

GitHub PoC★ 55

cve-2026-86060 PoC

CVE-2026-86060CRITICALbajo ataque22 sep 2026

SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

78RIESGO

abrir ↗

GitHub PoC

A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.

CVE-2026-41940CRITICALbajo ataqueransomware21 sep 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC★ 18

This repository documents the VectorFreed RCE chain and includes a PoC for CVE-2026-96889.

CVE-2026-96889HIGH21 sep 2026

Librsvg: use-after-free when xml includes have duplicated entities

41RIESGO

abrir ↗

GitHub PoC

Mass check/research exploit for HP HPLIP CVE-2026-91097–91106 (<3.26.6), PAPPL :8000 IPP probes + hpssd templates

CVE-2026-91097HIGH21 sep 2026

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

41RIESGO

abrir ↗

GitHub PoC★ 1

jvidhan/autofs-cve-2026-84568

CVE-2026-84568HIGH21 sep 2026

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS S

41RIESGO

abrir ↗

GitHub PoC

ExDev994/CVE-2026-90817

CVE-2026-90817CRITICAL21 sep 2026

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce

48RIESGO

abrir ↗

GitHub PoC

Security research lab — Unauthenticated RCE via insecure deserialization in ComfyUI v0.23.0 (CVSS 9.8). Isolated Docker environment, technical analysis and documentation.

CVE-2026-68771CRITICAL21 sep 2026

ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-74469 DiagSpill

CVE-2026-74469HIGH21 sep 2026

sctp: prevent peer transport count overflow

41RIESGO

abrir ↗

GitHub PoC★ 1

Netcore NBR200V2 traceroute command injection PoC (CVE-2026-94095); ubus JSON-RPC -> system() root RCE; for authorized testing

CVE-2026-94095CRITICAL21 sep 2026

Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection

48RIESGO

abrir ↗

GitHub PoC

Craft CMS CVE-2026-72781 Twig sandbox escape RCE PoC

CVE-2026-72781HIGH21 sep 2026

Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-68121 PPPoEject

CVE-2026-68121HIGH21 sep 2026

pppoe: reload header pointer after dev_hard_header()

41RIESGO

abrir ↗

GitHub PoC★ 2

Unauth REDCap RCE (CVE-2026-90817) mass check PoC — requires public survey hash for full validation.

CVE-2026-90817CRITICAL21 sep 2026

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce

48RIESGO

abrir ↗

GitHub PoC

Craft CMS CVE-2026-72778 condition.config RCE PoC

CVE-2026-72778HIGH21 sep 2026

Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

41RIESGO

abrir ↗

GitHub PoC★ 7

POC for CVE-2026-94128

CVE-2026-94128CRITICAL21 sep 2026

BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where

48RIESGO

abrir ↗

GitHub PoC★ 1

Technical details, proof of concept, and responsible disclosure timeline for CVE-2026-93528 (Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce).

CVE-2026-93528LOW21 sep 2026

NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page

28RIESGO

abrir ↗

GitHub PoC

CVE-2026-81000

CVE-2026-81000HIGH21 sep 2026

net: tun: bound receive headroom

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.