Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.154exploits catalogados

40.891CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.559Exploit-DB 24.489GitHub PoC 18.377VulnCheck XDB 10.605Nuclei 4584Metasploit 3540✓ solo verificadosrecientes populares riesgo

88.156 exploits

GitHub PoC★ 1

WordPress KeepInMind CVE-2026-9271 Exploit - Tool detecting stored XSS in KeepInMind plugin v0.8.4.2 and below. Built by Sudeepa Wanigarathna, it simulates CSS injection to hijack admin accounts. Features safe testing, attack simulation, credential capture, bulk scanning, reporting. Essential for security researchers.

CVE-2026-9271MEDIUM17 jul 2026

KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS

33RIESGO

GitHub PoC★ 1

CVE-2026-55579 – Unauthenticated RCE in Pheditor via hardcoded default password "admin". Full Python exploit with file upload & terminal execution. No dependencies.

CVE-2026-55579CRITICAL17 jul 2026

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

48RIESGO

GitHub PoC★ 7

CVE-2026-63030

CVE-2026-63030CRITICALbajo ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

Reproducer for CVE-2026-48203: Apache Camel camel-solr SolrParam./SolrField. header injection enabling Solr document-field injection and SSRF via the shards parameter (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48203CRITICAL17 jul 2026

Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

48RIESGO

GitHub PoC★ 1

bekwiner/cve-2026-47777

CVE-2026-47777HIGH17 jul 2026

Mastodon has a consent-check bypass in its remote Collections

41RIESGO

GitHub PoC

Reproducer for CVE-2026-48204: Apache Camel camel-mongodb-gridfs gridfs.* header injection overriding the GridFS operation (enumerate/read/delete files) from an unauthenticated HTTP request (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48204CRITICAL17 jul 2026

Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration

48RIESGO

GitHub PoC★ 5

CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework - SSRF→Erlang RPC→RCE→root privesc. Features: --detect safe check, --exec, --read-file, --privesc, --rpc, interactive shell, batch threading, file write, ws-url override, pipe support. KEV listed CVSS 10.0 actively exploited. Authorized testing only. Use Ethically, Stay Legal.

CVE-2026-15409CRITICALbajo ataqueransomware17 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

93RIESGO

Metasploit600

WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE

CVE-2026-60137MEDIUMbajo ataque17 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RIESGO

GitHub PoC

hg0434hongzh0/CVE-2026-14266

CVE-2026-14266HIGH17 jul 2026

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

41RIESGO

Metasploit300

WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion

CVE-2026-60137MEDIUMbajo ataque17 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RIESGO

Metasploit600

Langflow AI Public Flow Build Unauth RCE

CVE-2026-10134CRITICAL17 jul 2026

Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

63RIESGO

Metasploit600

Langflow AI auto_login RCE

CVE-2026-9198CRITICALbajo ataque17 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RIESGO

GitHub PoC★ 10

HIKRAVEN - Advanced Hikvision Security Assessment Platform for professional penetration testing. Detects 12+ CVEs including CVE-2021-36260 (CRITICAL), tests default credentials, performs network discovery, and generates professional security reports. For authorized security testing only! 🛡️🔒

CVE-2021-36260CRITICALbajo ataque17 jul 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RIESGO

Metasploit600

WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE

CVE-2026-63030CRITICALbajo ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

Pentest completo sobre Metasploitable: recon con nmap, explotación con Metasploit (CVE-2007-2447), extracción y cracking de credenciales, persistencia SSH

CVE-2007-2447—17 jul 2026

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RIESGO

GitHub PoC

Python port of the CVE-2023-23752 exploit — Joomla! < 4.2.8 unauthenticated information disclosure (user list + DB credentials leak)

CVE-2023-23752MEDIUMbajo ataque17 jul 2026

[20230201] - Core - Improper access check in webservice endpoints

100RIESGO

GitHub PoC

tungduongNT/CVE-2014-0160.

CVE-2014-0160HIGHbajo ataque17 jul 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

Metasploit300

WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion

CVE-2026-63030CRITICALbajo ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228).

CVE-2021-44228CRITICALbajo ataqueransomware16 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-14894CRITICAL16 jul 2026

Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

63RIESGO

GitHub PoC

CVE-2026-33017 Exploit | by infrar3d

CVE-2026-33017CRITICALbajo ataque16 jul 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

100RIESGO

GitHub PoC

CVE-2026-43499 exploit reproduction on jinghu (Xiaomi Pad 7 Ultra)

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

VulnCheck XDB

remote-with-credentials

CVE-2026-34197HIGHbajo ataque16 jul 2026

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

100RIESGO

GitHub PoC★ 2

CVE-2024-25600 - Unauthenticated RCE exploit for WordPress Bricks Builder Theme. Advanced exploitation framework with interactive shell, reverse shells, file upload/download, async scanning, stealth mode, proxy support, and multi-threaded vulnerability scanning. For authorized security testing only.

CVE-2024-25600CRITICAL16 jul 2026

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RIESGO

GitHub PoC

sadb98523-eng/CVE-2026-13001

CVE-2026-13001CRITICAL16 jul 2026

Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

63RIESGO

GitHub PoC★ 2

Super Forms Unauthenticated File Upload RCE | CVSS 9.8

CVE-2026-14894CRITICAL16 jul 2026

Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

63RIESGO

GitHub PoC★ 2

PoC tools for CVE-2026-58457: Unauthenticated OS Command Injection leading to remote root on Shenzhen Aitemi M300 Wi-Fi Repeater (MT02). Includes exploit, validator, payload generator, and Metasploit module. For educational and authorized pentesting only.

CVE-2026-58457CRITICAL16 jul 2026

Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp

48RIESGO

GitHub PoC★ 2

syxlox/CVE-2026-50369

CVE-2026-50369HIGH16 jul 2026

Windows Remote Desktop Services Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC

CVE-2026-43499 exploit with OnePlus Ace3 support

CVE-2026-43499HIGH16 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

Reproducer for CVE-2026-46726: Apache Camel camel-vertx-websocket unfiltered inbound header injection enabling SSRF and secret disclosure via property-placeholder resolution (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-46726HIGH16 jul 2026

Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.