Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.639exploits catalogados

40.918CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.560Exploit-DB 24.489GitHub PoC 18.402VulnCheck XDB 11.064Nuclei 4584Metasploit 3540✓ solo verificadosrecientes populares riesgo

88.056 exploits

GitHub PoC

Security case-study: reachability analysis PoE → fix → PoNE on Apache Airflow experimental-API unauthenticated access (CVE-2020-13927), real code reconstructed at historical commits. Demo only, not for use.

CVE-2020-13927CRITICALbajo ataque07 jul 2026

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th

100RIESGO

GitHub PoC

CVE-2026-14191 - Draft

CVE-2026-14191HIGH07 jul 2026

WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader

41RIESGO

VulnCheck XDB

initial-access

CVE-2021-41773HIGHbajo ataqueransomware07 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

GitHub PoC★ 3

CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, shell verification. For authorized security testing only.

CVE-2026-48908CRITICALbajo ataque07 jul 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

100RIESGO

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALbajo ataque07 jul 2026

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

GitHub PoC★ 2

CVE-2026-14762 exploit for Hotel & Tourism Reservation 1.0. Time-based blind SQL injection via /admin/rooms.php?delete. Dumps DB, tables, columns, reads files, writes webshells. Multi-threaded, proxy support, interactive shell. CVSS 7.3. Authorized & Legal testing only.

CVE-2026-14762MEDIUM07 jul 2026

code-projects Hotel and Tourism Reservation Room Management rooms.php sql injection

33RIESGO

GitHub PoC★ 2

CVE-2026-8451 - Citrix NetScaler SAML Memory Overread (CitrixBleed) - PoC & Analysis | CVSS 8.8 | AMN SECURITY

CVE-2026-8451HIGH07 jul 2026

Insufficient input validation leading to memory overread

46RIESGO

GitHub PoC★ 1

A17-ba/CVE-2026-51119

CVE-2026-51119CRITICAL07 jul 2026

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser co

48RIESGO

Exploit-DB

Hydra - Stack Buffer Overflow

CVE-2026-56766HIGHremotelinux07 jul 2026

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

41RIESGO

GitHub PoC

PoC for CVE-2026-54350 — Budibase unauthenticated NoSQL operator injection (CVSS 10.0). Read/mass-write any document collection via a PUBLIC query.

CVE-2026-54350CRITICAL07 jul 2026

Budibase: Anonymous NoSQL operator injection via published-app query templates

48RIESGO

GitHub PoC

Laboratory validation of CVE-2026-48282 in Adobe ColdFusion RDS, covering arbitrary CFM file write, code execution as the ColdFusion service user, auditd and PCAP evidence, event timeline reconstruction, and SOC detection recommendations. Includes Polish and English reports.

CVE-2026-48282CRITICALbajo ataque07 jul 2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

100RIESGO

GitHub PoC

🐳 docker-compose 를 활용한 취약한 환경 구성 및 검증 (vulhub 한글판)

CVE-2026-40519HIGH07 jul 2026

Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()

21RIESGO

GitHub PoC★ 3

CVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY

CVE-2026-42271HIGHbajo ataque07 jul 2026

LiteLLM: Authenticated command execution via MCP stdio test endpoints

100RIESGO

GitHub PoC

Bypass Authentication

CVE-2026-48611CRITICAL07 jul 2026

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or

63RIESGO

GitHub PoC★ 1

CVE-2026-45659 - Microsoft SharePoint Deserialization RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY

CVE-2026-45659HIGHbajo ataqueransomware07 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

93RIESGO

GitHub PoC★ 4

CVE-2026-53359

CVE-2026-53359HIGH07 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RIESGO

VulnCheck XDB

initial-access

CVE-2026-48282CRITICALbajo ataque07 jul 2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

100RIESGO

GitHub PoC★ 1

CVE-2026-39492 — WP Maps (wp-google-map-plugin) <= 4.9.1 Unauthenticated Blind SQL Injection Mass Scanner | sqlmap-style detection | backtick bypass esc_sql() | 100K+ installs

CVE-2026-39492CRITICAL07 jul 2026

WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability

48RIESGO

GitHub PoC★ 101

CVE-2026-42980 PUBLIC EXPLOIT + RESEARCH

CVE-2026-42980HIGH07 jul 2026

NT OS Kernel Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC★ 2

Linux 内核升级指南 - 修复 CVE-2026-53359

CVE-2026-53359HIGH07 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RIESGO

GitHub PoC

Vtiger CRM 8.3.0, 8.4.0 Module Import Authenticated RCE PoC

CVE-2026-23698HIGH07 jul 2026

Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload

41RIESGO

GitHub PoC

NEO-SQLi — exploit Django _connector SQL Injection (CVE-2025-64459) | canal RedTeam Brasil

CVE-2025-64459CRITICAL07 jul 2026

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

53RIESGO

Exploit-DB

MCPJam Inspector - Remote Code Execution

CVE-2026-23744CRITICALwebappsmultiple07 jul 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

GitHub PoC

whs-homework

CVE-2021-41773HIGHbajo ataqueransomware07 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

Exploit-DB

Tenable Nessus 10.12.1 - SQL Injection

CVE-2026-57588LOWwebappsmultiple07 jul 2026

SQL Injection in Nessus via Malicious Scan Result File Import

28RIESGO

GitHub PoC

CVE-2026-24061-PoC

CVE-2026-24061CRITICALbajo ataque06 jul 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

Exploit-DB

Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass

CVE-2026-44225CRITICALwebappsmultiple06 jul 2026

Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files

48RIESGO

Exploit-DB

Joomla Extension 4.1.4 - PHP Object injection

CVE-2026-48909CRITICALwebappsphp06 jul 2026

Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

63RIESGO

Exploit-DB

WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)

CVE-2026-49069HIGHwebappsmultiple06 jul 2026

WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability

56RIESGO

GitHub PoC

Exploit for Authenticated Remote Code Execution (RCE) in Krayin CRM v2.2.x (CVE-2026-38526)

CVE-2026-38526CRITICAL06 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.