Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.644exploits catalogados

40.922CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.560Exploit-DB 24.489GitHub PoC 18.407VulnCheck XDB 11.064Nuclei 4584Metasploit 3540✓ solo verificadosrecientes populares riesgo

88.154 exploits

VulnCheck XDB

initial-access

CVE-2026-0257HIGHbajo ataqueransomware15 jun 2026

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

100RIESGO

abrir ↗

GitHub PoC

Research and analysis of the ServiceNow Virtual Agent vulnerability (CVE-2025-12420), including attack flow, MITRE ATT&CK mapping, detection strategies, and mitigation recommendations.

CVE-2025-12420CRITICAL15 jun 2026

Unauthenticated Privilege Escalation in ServiceNow AI Platform

60RIESGO

abrir ↗

GitHub PoC

CVE-2026-54596 - Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration

CVE-2026-54596HIGH15 jun 2026

ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration

41RIESGO

abrir ↗

GitHub PoC

ikarolaborda/CVE-2026-40176

CVE-2026-40176HIGH15 jun 2026

Composer is vulnerable to Command Injection via Malicious Perforce Repository

41RIESGO

abrir ↗

GitHub PoC

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php

CVE-2026-37072CRITICAL15 jun 2026

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-update

48RIESGO

abrir ↗

GitHub PoC★ 1

This repository documents CVE-2026-48849, a Stored Cross-Site Scripting (XSS), HTML Injection, and CSS Injection vulnerability discovered in Roundcube Webmai

CVE-2026-48849MEDIUM15 jun 2026

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored valu

33RIESGO

abrir ↗

GitHub PoC

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.

CVE-2026-37066MEDIUM15 jun 2026

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Man

33RIESGO

abrir ↗

GitHub PoC

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.

CVE-2026-37067MEDIUM15 jun 2026

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauth

33RIESGO

abrir ↗

GitHub PoC★ 3

PoC exploit for CVE-2026-53519.

CVE-2026-53519CRITICAL15 jun 2026

Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

63RIESGO

abrir ↗

VulnCheck XDB

denial-of-service

CVE-2021-44228CRITICALbajo ataqueransomware15 jun 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

abrir ↗

GitHub PoC

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.

CVE-2026-37068HIGH15 jun 2026

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allow

41RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-42945CRITICAL15 jun 2026

NGINX ngx_http_rewrite_module vulnerability

60RIESGO

abrir ↗

GitHub PoC

TryHackMe SOC Level 1 — Follina CVE-2022-30190, Nim C2, Chisel, PrintSpoofer, backdoor accounts

CVE-2022-30190HIGHbajo ataqueransomware15 jun 2026

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 1

Defensive research notes for CVE-2026-5950, a BIND 9 resolver DoS vulnerability credited to Billy Baraja (BielraX).

CVE-2026-5950MEDIUM14 jun 2026

Unbounded resend loop in BIND 9 resolver

33RIESGO

abrir ↗

GitHub PoC

webshellseo8/CVE-2026-53787-POC-

CVE-2026-53787CRITICAL14 jun 2026

Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

63RIESGO

abrir ↗

GitHub PoC

kaleth4/CVE-2022-30190

CVE-2022-30190HIGHbajo ataqueransomware14 jun 2026

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2017-0144

CVE-2017-0144HIGHbajo ataqueransomware14 jun 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2017-0144

CVE-2017-0144HIGHbajo ataqueransomware14 jun 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-20253 - Splunk Enterprise

CVE-2026-20253CRITICALbajo ataque14 jun 2026

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

100RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2021-41773HIGHbajo ataqueransomware14 jun 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2017-0144HIGHbajo ataqueransomware14 jun 2026

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2026-20245

CVE-2026-20245HIGHbajo ataque14 jun 2026

Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability

76RIESGO

abrir ↗

GitHub PoC

Python RCE PoC with reverse-shell listener for CVE-2026-42945 (NGINX Rift)

CVE-2026-42945CRITICAL14 jun 2026

NGINX ngx_http_rewrite_module vulnerability

60RIESGO

abrir ↗

GitHub PoC★ 1

rohit-sundar/cve-2026-23744

CVE-2026-23744CRITICAL14 jun 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC

CVE-2026-5513: Bookly <= 27.2 Stored XSS via Cookie (Unauthenticated)

CVE-2026-5513HIGH14 jun 2026

Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie

41RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-6279CRITICAL14 jun 2026

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

63RIESGO

abrir ↗

GitHub PoC

Apache HTTP Server 2.4.49 Path Traversal Vulnerability Reproduction

CVE-2021-41773HIGHbajo ataqueransomware14 jun 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2024-3094 XZ Utils backdoor research - attack surface visualiser, system vulnerability checker, and general Linux CVE assessment tool

CVE-2024-3094CRITICAL14 jun 2026

Xz: malicious code in distributed source

70RIESGO

abrir ↗

GitHub PoC

CVE-2025-14847 mongobleed python file

CVE-2025-14847HIGHbajo ataque14 jun 2026

Zlib compressed protocol header length confusion may allow memory read

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-20127

CVE-2026-20127CRITICALbajo ataque14 jun 2026

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.