Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.639exploits catalogados

40.918CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.560Exploit-DB 24.489GitHub PoC 18.402VulnCheck XDB 11.064Nuclei 4584Metasploit 3540✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC★ 16

Proof of concept exploit for CVE-2026-3775/CVE-2026-3780 and CVE-2026-57239 which lets you obtain NT AUTHORITY\SYSTEM rights via the Foxit PDF Reader updater service.

CVE-2026-57239HIGH08 jul 2026

Foxit PDF Editor/Reader Local Privilege Escalation

41RIESGO

GitHub PoC

Tracking ITScape (CVE-2026-46316), the KVM/arm64 guest-to-host escape

CVE-2026-46316CRITICAL08 jul 2026

KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

48RIESGO

GitHub PoC★ 12

Apache Solr instances that may be affected by CVE-2026-44825, related to Velocity Template Remote Code Execution (RCE) conditions.

CVE-2026-44825HIGH08 jul 2026

Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users

56RIESGO

GitHub PoC★ 1

CVE-2026-0257 - Palo Alto PAN-OS GlobalProtect Auth Override Cookie Forgery - PoC & Analysis | CVSS 9.1 CRITICAL CISA KEV | AMN SECURITY

CVE-2026-0257HIGHbajo ataqueransomware08 jul 2026

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

100RIESGO

GitHub PoC★ 1

CVE-2026-49777 - WooCommerce Product Slider Pro Malicious Software Implantation RCE - PoC & Analysis | CVSS 10.0 CRITICAL | AMN SECURITY

CVE-2026-49777CRITICAL08 jul 2026

WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability

63RIESGO

Exploit-DB

Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure

CVE-2025-60188HIGHwebappsmultiple08 jul 2026

WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability

56RIESGO

GitHub PoC★ 35

CVE-2026-25262 applicability to Snapdragon 8 Gen 1 — experimental results

CVE-2026-25262MEDIUM08 jul 2026

Write-what-where Condition in Primary Bootloader

33RIESGO

GitHub PoC

junghyeonkum/CVE-2022-24706

CVE-2022-24706CRITICALbajo ataque08 jul 2026

Remote Code Execution Vulnerability in Packaging

100RIESGO

GitHub PoC★ 1

CVE-2026-8206 - Kirki WordPress Plugin Unauthenticated Account Takeover - PoC & Analysis | CVSS 9.8 CRITICAL | AMN SECURITY

CVE-2026-8206CRITICAL08 jul 2026

Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

48RIESGO

GitHub PoC

Bypass Authentication

CVE-2026-48611CRITICAL07 jul 2026

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or

63RIESGO

Exploit-DB

WordPress Bricks Builder Theme - RCE

CVE-2024-25600CRITICALwebappsmultiple07 jul 2026

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RIESGO

Exploit-DB

Discuz! X5.0 - Authentication Bypass

CVE-2026-49952CRITICALwebappsmultiple07 jul 2026

Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle

63RIESGO

GitHub PoC

CVE-2026-14191 - Draft

CVE-2026-14191HIGH07 jul 2026

WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader

41RIESGO

GitHub PoC★ 1

CVE-2026-45659 - Microsoft SharePoint Deserialization RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY

CVE-2026-45659HIGHbajo ataqueransomware07 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

93RIESGO

GitHub PoC★ 101

CVE-2026-42980 PUBLIC EXPLOIT + RESEARCH

CVE-2026-42980HIGH07 jul 2026

NT OS Kernel Elevation of Privilege Vulnerability

41RIESGO

Exploit-DB

Tenable Nessus 10.12.1 - SQL Injection

CVE-2026-57588LOWwebappsmultiple07 jul 2026

SQL Injection in Nessus via Malicious Scan Result File Import

28RIESGO

GitHub PoC

Laboratory validation of CVE-2026-48282 in Adobe ColdFusion RDS, covering arbitrary CFM file write, code execution as the ColdFusion service user, auditd and PCAP evidence, event timeline reconstruction, and SOC detection recommendations. Includes Polish and English reports.

CVE-2026-48282CRITICALbajo ataque07 jul 2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

100RIESGO

GitHub PoC

CVE-2021-3156 (Baron Samedit) Report and Research

CVE-2021-3156HIGHbajo ataque07 jul 2026

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

GitHub PoC★ 2

CVE-2026-8451 - Citrix NetScaler SAML Memory Overread (CitrixBleed) - PoC & Analysis | CVSS 8.8 | AMN SECURITY

CVE-2026-8451HIGH07 jul 2026

Insufficient input validation leading to memory overread

46RIESGO

GitHub PoC

Frontend File Manager Plugin (WordPress) <= 23.6 - Unauthenticated Arbitrary File Deletion to RCE

CVE-2026-12277HIGH07 jul 2026

Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal

41RIESGO

GitHub PoC★ 1

CVE-2026-39492 — WP Maps (wp-google-map-plugin) <= 4.9.1 Unauthenticated Blind SQL Injection Mass Scanner | sqlmap-style detection | backtick bypass esc_sql() | 100K+ installs

CVE-2026-39492CRITICAL07 jul 2026

WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability

48RIESGO

GitHub PoC

🐳 docker-compose 를 활용한 취약한 환경 구성 및 검증 (vulhub 한글판)

CVE-2026-40519HIGH07 jul 2026

Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()

21RIESGO

GitHub PoC★ 3

CVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY

CVE-2026-42271HIGHbajo ataque07 jul 2026

LiteLLM: Authenticated command execution via MCP stdio test endpoints

100RIESGO

GitHub PoC★ 3

A complete walkthrough and exploit for CVE-2019-9978 - Unauthenticated Remote Code Execution in Social Warfare WordPress plugin ≤ 3.5.2. Includes vulnerable code analysis and payload examples.

CVE-2019-9978MEDIUMbajo ataque07 jul 2026

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RIESGO

GitHub PoC

Shellshock

CVE-2014-6271CRITICALbajo ataque07 jul 2026

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RIESGO

GitHub PoC★ 3

CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, shell verification. For authorized security testing only.

CVE-2026-48908CRITICALbajo ataque07 jul 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

100RIESGO

Exploit-DB

MCPJam Inspector - Remote Code Execution

CVE-2026-23744CRITICALwebappsmultiple07 jul 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

GitHub PoC

NEO-SQLi — exploit Django _connector SQL Injection (CVE-2025-64459) | canal RedTeam Brasil

CVE-2025-64459CRITICAL07 jul 2026

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

53RIESGO

GitHub PoC

whs-homework

CVE-2021-41773HIGHbajo ataqueransomware07 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

Exploit-DB

Flowise 3.1.3 - arbitrary code execution

CVE-2026-58057LOWwebappsmultiple07 jul 2026

Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity

28RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.