Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.794exploits catalogados

36.057CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientes populares riesgo

14.316 exploits

GitHub PoC★ 1

CVE-2026-41940

CVE-2026-41940CRITICALbajo ataqueransomware24 jul 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC

Lite-os15/Lab-001-Gitea-CVE-2026-20896-

CVE-2026-20896CRITICAL24 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

75RIESGO

abrir ↗

GitHub PoC

blue-chocolates/CVE-2016-10033

CVE-2016-10033CRITICALbajo ataque24 jul 2026

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RIESGO

abrir ↗

GitHub PoC

Giangdurian/CVE-2026-63030-CVE-2026-60137

CVE-2026-63030CRITICALbajo ataque24 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RIESGO

abrir ↗

GitHub PoC

Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation

CVE-2015-1328—24 jul 2026

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no

50RIESGO

abrir ↗

GitHub PoC★ 1

最原始的

CVE-2026-43499HIGH24 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

Reproduction of cve-2025-0282-ivanti_rce_reproduction

CVE-2025-0282CRITICALbajo ataqueransomware24 jul 2026

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RIESGO

abrir ↗

GitHub PoC★ 1

Discuz! X5.0 Authentication Bypass Exploit Framework (CVE-2026-49952) - Critical vulnerability allowing unauthenticated database backup access via UC_KEY encryption oracle token reuse. CVSS 9.1. Full-featured tool with version detection, multi-payload attacks, interactive shell, and automated exploitation. Authorized testing only.

CVE-2026-49952CRITICAL24 jul 2026

Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle

63RIESGO

abrir ↗

GitHub PoC

sbimoxa/cve-2021-43798-lab

CVE-2021-43798HIGHbajo ataque24 jul 2026

Grafana path traversal

100RIESGO

abrir ↗

GitHub PoC

Pedit COW – Linux Kernel Local Privilege Escalation (CVE-2026-46331)

CVE-2026-46331HIGH24 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

abrir ↗

GitHub PoC

WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi (CVE-2026-63030 + CVE-2026-60137)

CVE-2026-63030CRITICALbajo ataque24 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RIESGO

abrir ↗

GitHub PoC

Security Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field

CVE-2026-66748HIGH24 jul 2026

Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

41RIESGO

abrir ↗

GitHub PoC

EasyStore Joomla Pre-Auth SQL Injection via filter_sortby Direction (CVE-2026-65761, CVSS 9.3)

CVE-2026-65761CRITICAL24 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1

48RIESGO

abrir ↗

GitHub PoC★ 4

👾 CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework ⚡Bash & Python versions. Features: --detect safe check, --exploit combo/unsigned/xsw/nameid/all, --shodan integration, --tor support, mass scanning, JSON/CSV/JSONL output, cookie validation. 🛡️ CVSS 9.9 Critical - Use Ethically, Stay Legal. 🔒

CVE-2026-60206CRITICAL24 jul 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

48RIESGO

abrir ↗

GitHub PoC

is an advanced security research framework designed to model, analyze, and demonstrate Local Privilege Escalation (LPE) mechanics associated with kernel-level race conditions and filesystem structure vulnerabilities (CVE-2026-64600 / RefluXFS)

CVE-2026-64600HIGH24 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RIESGO

abrir ↗

GitHub PoC★ 33

cve cve-2026-60206 weblogic saml exploit poc vulnerability oracle scanner security

CVE-2026-60206CRITICAL24 jul 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

48RIESGO

abrir ↗

GitHub PoC

risorse di ricerca per cve-2026-7228

CVE-2026-7228MEDIUM24 jul 2026

SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection

33RIESGO

abrir ↗

GitHub PoC

CVE-2021-44228 Log4Shell - Apache Log4j2 JNDI Injection RCE

CVE-2021-44228CRITICALbajo ataqueransomware24 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

kxom9ks/CVE-2024-27198

CVE-2024-27198CRITICALbajo ataqueransomware24 jul 2026

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

100RIESGO

abrir ↗

GitHub PoC

Security Advisory: Negative Chunk-Size Parsing Causes Memory Corruption in facil.io

CVE-2026-66731HIGH24 jul 2026

facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-64600 - Draft - Check todo

CVE-2026-64600HIGH23 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RIESGO

abrir ↗

GitHub PoC

CVE Reproduction: cve-2026-63030_60137-wordpress_rce_reproduction

CVE-2026-63030CRITICALbajo ataque23 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RIESGO

abrir ↗

GitHub PoC★ 11

DavidCarliez/CVE-2026-66804-CrossDevice-LPE

CVE-2026-66804HIGH23 jul 2026

Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC

ghostpels/CVE-2026-13001

CVE-2026-13001CRITICAL23 jul 2026

Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

63RIESGO

abrir ↗

GitHub PoC

finding by nvth

CVE-2026-59880HIGH23 jul 2026

Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

21RIESGO

abrir ↗

GitHub PoC

Metabase CVE-2026-59827 Vulnerability Scanner

CVE-2026-59827CRITICAL23 jul 2026

Metabase: Unsafe Deserialization of H2 Query Results

48RIESGO

abrir ↗

GitHub PoC

Proof-of-concept and offensive security research analyzing CVE-2026-23744 (MCPJam Inspector Unauthenticated RCE, Patched in v1.4.3+).

CVE-2026-23744CRITICAL23 jul 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC

0xdak/CVE-2026-63766_exploit

CVE-2026-63766CRITICAL23 jul 2026

GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

48RIESGO

abrir ↗

GitHub PoC

Initialized & connected PostgreSQL to Metasploit. Reconnoitered 10.1.16.0/24 with Nmap and imported results. Enumerated hosts/services using SYN, SMB & LDAP scanners. Exploited DC10 via ZeroLogon (CVE-2020-1472), dumped AD NTLM hashes with Impacket, performed Pass-the-Hash, then gained a Meterpreter reverse shell.

CVE-2020-1472MEDIUMbajo ataqueransomware23 jul 2026

Netlogon Elevation of Privilege Vulnerability

100RIESGO

abrir ↗

GitHub PoC

Legacy HPE iMC vuln

CVE-2019-5392—23 jul 2026

A disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than ve

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.