Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados

36.206CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientes populares riesgo

14.316 exploits

GitHub PoC★ 1

Abdal CVE-2026-60137 is an advanced WordPress security scanner for identifying systems potentially affected by the CVE-2026-60137 SQL Injection vulnerability. Developed by Ebrahim Shafiei (EbraSha) for vulnerability assessment, security research, and authorized penetration testing.

CVE-2026-60137MEDIUMbajo ataque18 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

100RIESGO

GitHub PoC★ 15

WP2Shell - CVE-2026-63030 / CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `/wp-json/batch/v1` endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and achieve Remote Code Execution (RCE) on vulnerable WordPress installations.

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RIESGO

GitHub PoC

wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.

CVE-2026-60137MEDIUMbajo ataque18 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

100RIESGO

GitHub PoC★ 2

Abdal CVE-2026-63030 is a professional WordPress vulnerability scanner designed to detect exposure to CVE-2026-63030 through version analysis and REST API security checks. Developed by Ebrahim Shafiei (EbraSha) for cybersecurity research, penetration testing, and WordPress security assessment.

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RIESGO

GitHub PoC

vivo X Fold6 (V2545A) GhostLock CVE-2026-43499 临时root/永久解锁研究

CVE-2026-43499HIGH18 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 5

Use CVE-2026-43074 to disable SELinux on Android (Linux 6.6/6.12)

CVE-2026-43074HIGH18 jul 2026

eventpoll: defer struct eventpoll free to RCU grace period

41RIESGO

GitHub PoC

Hunt-Benito/zephyr-lwm2m-firmware-update-oob-read-cve-2026-10672-truncated-package-uri

CVE-2026-10672HIGH18 jul 2026

Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

41RIESGO

GitHub PoC

Technical analysis of the cPanel/WHM auth bypass

CVE-2026-41940CRITICALbajo ataqueransomware18 jul 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

GitHub PoC★ 6

wp2shell - WordPress CVE-2026-63030 Exploit & Scanner

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RIESGO

GitHub PoC★ 2

2932796375github/CVE-2026-43499_OPPO-MT6835

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 1

MiaPatsune/cve-2026-43499

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

Reproducer for CVE-2026-48204: Apache Camel camel-mongodb-gridfs gridfs.* header injection overriding the GridFS operation (enumerate/read/delete files) from an unauthenticated HTTP request (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48204CRITICAL17 jul 2026

Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration

48RIESGO

GitHub PoC

Reproducer for CVE-2026-48203: Apache Camel camel-solr SolrParam./SolrField. header injection enabling Solr document-field injection and SSRF via the shards parameter (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48203CRITICAL17 jul 2026

Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

48RIESGO

GitHub PoC★ 1

CVE-2026-55579 – Unauthenticated RCE in Pheditor via hardcoded default password "admin". Full Python exploit with file upload & terminal execution. No dependencies.

CVE-2026-55579CRITICAL17 jul 2026

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

48RIESGO

GitHub PoC★ 5

CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework 🔥 SSRF→Erlang RPC→RCE→root privesc. Features: --detect safe check, --exec, --read-file, --privesc, --rpc, interactive shell, batch threading, file write, ws-url override, pipe support.🛡️ KEV listed CVSS 10.0 actively exploited. Authorized testing only. Use Ethically, Stay Legal. 🔒

CVE-2026-15409CRITICALbajo ataqueransomware17 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

100RIESGO

GitHub PoC

Python port of the CVE-2023-23752 exploit — Joomla! < 4.2.8 unauthenticated information disclosure (user list + DB credentials leak)

CVE-2023-23752MEDIUMbajo ataque17 jul 2026

[20230201] - Core - Improper access check in webservice endpoints

100RIESGO

GitHub PoC

Pentest completo sobre Metasploitable: recon con nmap, explotación con Metasploit (CVE-2007-2447), extracción y cracking de credenciales, persistencia SSH

CVE-2007-2447—17 jul 2026

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RIESGO

GitHub PoC

jaf0rk/CVE-2026-14431

CVE-2026-14431HIGH17 jul 2026

Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside

41RIESGO

GitHub PoC★ 1

WordPress KeepInMind CVE-2026-9271 Exploit - Tool detecting stored XSS in KeepInMind plugin v0.8.4.2 and below. Built by Sudeepa Wanigarathna, it simulates CSS injection to hijack admin accounts. Features safe testing, attack simulation, credential capture, bulk scanning, reporting. Essential for security researchers.

CVE-2026-9271MEDIUM17 jul 2026

KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS

33RIESGO

GitHub PoC

fancyzll/CVE-2026-43499_OPPO-MT6835

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 6

sorrow404Null/CVE-2026-43499-RMX5200

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC

Academic proof-of-concept demonstrating CVE-2026-15583 for authorized security research.

CVE-2026-15583HIGH17 jul 2026

SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

41RIESGO

GitHub PoC★ 44

CVE-2026-50416: Windows 11 KASLR bypass

CVE-2026-50416LOW17 jul 2026

Win32k Information Disclosure Vulnerability

28RIESGO

GitHub PoC★ 1

Reproducer for CVE-2026-48205: Apache Camel camel-dns dns.* header injection redirecting DNS queries to an attacker-controlled resolver (SSRF via DNS) and enabling internal-hostname reconnaissance (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48205CRITICAL17 jul 2026

Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

48RIESGO

GitHub PoC★ 54

CVE-2026-63030, CVE-2026-60137, wp2shell scanner

CVE-2026-63030CRITICALbajo ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RIESGO

GitHub PoC

hg0434hongzh0/CVE-2026-14266

CVE-2026-14266HIGH17 jul 2026

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

41RIESGO

GitHub PoC

tungduongNT/CVE-2014-0160.

CVE-2014-0160HIGHbajo ataque17 jul 2026

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

GitHub PoC★ 865

KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 3

HIKRAVEN - Advanced Hikvision Security Assessment Platform for professional penetration testing. Detects 12+ CVEs including CVE-2021-36260 (CRITICAL), tests default credentials, performs network discovery, and generates professional security reports. For authorized security testing only! 🛡️🔒

CVE-2021-36260CRITICALbajo ataque17 jul 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RIESGO

GitHub PoC

CVE-2026-38526 Exploit | by infrar3d

CVE-2026-38526CRITICAL17 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.