Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.644exploits catalogados

40.922CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.560Exploit-DB 24.489GitHub PoC 18.407VulnCheck XDB 11.064Nuclei 4584Metasploit 3540✓ solo verificadosrecientes populares riesgo

88.056 exploits

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALbajo ataque29 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALbajo ataque29 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

abrir ↗

GitHub PoC

rufflabs/crushftp_cve-2025-31161

CVE-2025-31161CRITICALbajo ataqueransomware29 jun 2026

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RIESGO

abrir ↗

GitHub PoC

rufflabs/ludus_crushftp_cve-2025-31161_sim

CVE-2025-31161CRITICALbajo ataqueransomware29 jun 2026

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RIESGO

abrir ↗

GitHub PoC

DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503

CVE-2026-43503HIGH29 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

56RIESGO

abrir ↗

GitHub PoC

rufflabs/ludus_crushftp_cve-2025-31161

CVE-2025-31161CRITICALbajo ataqueransomware29 jun 2026

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RIESGO

abrir ↗

GitHub PoC★ 2

Python poc, exploit for CVE-2025-69212

CVE-2026-69212MEDIUM28 jun 2026

Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect

33RIESGO

abrir ↗

GitHub PoC

Hack The Box - DevHub Machine Walkthrough (Medium Linux, CVE-2026-23744, Chisel Tunneling, Jupyter, Root Privilege Escalation)

CVE-2026-23744CRITICAL28 jun 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-23744CRITICAL28 jun 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-12485

CVE-2026-12485CRITICAL28 jun 2026

GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command

48RIESGO

abrir ↗

GitHub PoC★ 192

CVE-2026-41940 authentication bypass vulnerability proof-of-concept

CVE-2026-41940CRITICALbajo ataqueransomware28 jun 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC

Why-Shell/CVE-2026-38751

CVE-2026-38751HIGH28 jun 2026

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionali

41RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2020-7247CRITICALbajo ataque28 jun 2026

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RIESGO

abrir ↗

GitHub PoC

Goal is to triage well known attack and learn how security teams quickly respond.

CVE-2021-44228CRITICALbajo ataqueransomware28 jun 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

solmin111/OpenSMTPD-CVE-2020-7247-

CVE-2020-7247CRITICALbajo ataque28 jun 2026

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RIESGO

abrir ↗

GitHub PoC

Double-free in Apache httpd mod_http2 stream cleanup leading to pre-auth RCE

CVE-2026-23918HIGH28 jun 2026

Apache HTTP Server: http2: double free and possible RCE on early reset

53RIESGO

abrir ↗

GitHub PoC

Unauthenticated RCE PoC for CVE-2026-48908 SP Page Builder (Joomla) arbitrary file upload and remote code execution exploit with mass scaning support.

CVE-2026-48908CRITICALbajo ataque28 jun 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

100RIESGO

abrir ↗

GitHub PoC

React2Shell: CVE-2025-55182 exploit from tryhackme‼️

CVE-2025-55182CRITICALbajo ataqueransomware28 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

Goal is to triage well known attack and learn how security teams quickly respond.

CVE-2021-44228CRITICALbajo ataqueransomware28 jun 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-49048 — JoomCCK 6.4.0 Unauthenticated SQL Injection (CVSS 9.8)

CVE-2026-49048HIGH28 jun 2026

Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1

41RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALbajo ataqueransomware28 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-48908CRITICALbajo ataque28 jun 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

100RIESGO

abrir ↗

GitHub PoC★ 6

CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9

CVE-2026-46331HIGH28 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

abrir ↗

GitHub PoC

POC for CVE-2026-41179

CVE-2026-41179CRITICAL28 jun 2026

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

63RIESGO

abrir ↗

VulnCheck XDB

local

CVE-2023-0386HIGHbajo ataque28 jun 2026

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa

86RIESGO

abrir ↗

GitHub PoC★ 3

DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503

CVE-2026-43503HIGH28 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

56RIESGO

abrir ↗

GitHub PoC

CVE-2026-46331 - Draft

CVE-2026-46331HIGH27 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-48907 is a CVSS 10.0 pre-auth RCE in Joomla Content Editor affecting all versions ≤ 2.9.99.4. The Grayxploit team breaks down the 3-weakness chain — missing auth, no extension validation, and an unsafe upload flag — that lets attackers pop a shell in 3 HTTP requests.

CVE-2026-48907CRITICALbajo ataque27 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

abrir ↗

GitHub PoC★ 1

WP Full Stripe Free <= 8.4.3 - Missing Authorization

CVE-2026-12432MEDIUM27 jun 2026

Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter

33RIESGO

abrir ↗

GitHub PoC★ 148

CVE-2026-43499 PoC

CVE-2026-43499HIGH27 jun 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.