Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
14.316 exploits
GitHub PoC★ 1
PoC untuk CVE-2026-0740: Ninja Forms File Uploads <= 3.3.26 — Unauthenticated Arbitrary File Upload yang dapat mengarah ke RCE.
CVE-2026-0740CRITICAL11 jul 2026
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RIESGO
abrir ↗
GitHub PoC
Lim-ahmin/CVE-2021-43798
CVE-2021-43798HIGHbajo ataque11 jul 2026
Grafana path traversal
100RIESGO
abrir ↗
GitHub PoC
Web application security assessment of DVWA using OWASP ZAP — vulnerability scanning, RCE (CVE-2012-1823) analysis, and remediation report.
CVE-2012-1823CRITICALbajo ataque11 jul 2026
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
100RIESGO
abrir ↗
GitHub PoC
CVE-2026-23744 MCPJam Inspector unauthenticated RCE PoC
CVE-2026-23744CRITICAL11 jul 2026
REC in MCPJam inspector due to HTTP Endpoint exposes
75RIESGO
abrir ↗
GitHub PoC
PoC for jenkins 2.63 CVE-2019-1003030
CVE-2019-1003030CRITICALbajo ataque11 jul 2026
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
100RIESGO
abrir ↗
GitHub PoC
Wazuh + Suricata SOC lab detecting real exploits (CVE-2011-2523) and brute-force attacks, with custom detection rules for gaps in default IDS signatures.
CVE-2011-2523—11 jul 2026
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗
GitHub PoC
jini135wii/CVE-2019-15107
CVE-2019-15107CRITICALbajo ataqueransomware11 jul 2026
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RIESGO
abrir ↗
GitHub PoC★ 3
This is an exploit for CVE-2026-46215 (Linux Kernel Use After Free) Adapted for Linux 7.0 !!! by Antonius (ev1lut10n / sw0rdm4n)
CVE-2026-46215HIGH11 jul 2026
drm: Set old handle to NULL before prime swap in change_handle
41RIESGO
abrir ↗
GitHub PoC
Instant Appointment <= 1.2 — Unauthenticated Arbitrary File Upload to RCE via add_service_front AJAX | CVSS 9.8
CVE-2026-15282CRITICAL11 jul 2026
Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload
28RIESGO
abrir ↗
GitHub PoC
OS Command Injection in Health Check → Remote Code Execution
CVE-2026-59734HIGH11 jul 2026
Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution
21RIESGO
abrir ↗
GitHub PoC
A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x
CVE-2026-38526CRITICAL11 jul 2026
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a
48RIESGO
abrir ↗
GitHub PoC
[AI-assisted] Root method for Lenovo IdeaTab A1000G (MT8317, kernel 3.4.0, Android 4.1) via CVE-2016-5195 (Dirty COW)
CVE-2016-5195HIGHbajo ataque11 jul 2026
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RIESGO
abrir ↗
GitHub PoC★ 6
Termux Privilege Escalation Tool & Root Manager - CVE-2026-43501
CVE-2026-43501CRITICAL11 jul 2026
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
48RIESGO
abrir ↗
GitHub PoC
WHS 4기 이희수. kr-vulhub 과제 제출물
CVE-2021-41773HIGHbajo ataqueransomware11 jul 2026
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗
GitHub PoC
MW-HF/Drupal-CVE-2026-9082
CVE-2026-9082CRITICALbajo ataque11 jul 2026
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
100RIESGO
abrir ↗
GitHub PoC
An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database.
CVE-2026-40887CRITICAL11 jul 2026
@vendure/core has a SQL Injection vulnerability
43RIESGO
abrir ↗
GitHub PoC★ 2
Balbooa Forms (com_baforms) < 2.4.1 — Unauthenticated File Upload to RCE via form.uploadAttachmentFile | CVSS 9.8 | CISA KEV
CVE-2026-56291CRITICALbajo ataque11 jul 2026
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
100RIESGO
abrir ↗
GitHub PoC
[AI-assisted] Root method for Lenovo IdeaTab A1000G (MT8317, kernel 3.4.0, Android 4.1) via CVE-2016-5195 (Dirty COW)
CVE-2016-5195HIGHbajo ataque11 jul 2026
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RIESGO
abrir ↗
GitHub PoC
Exploit for CVE-2022-26134
CVE-2022-26134CRITICALbajo ataqueransomware10 jul 2026
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RIESGO
abrir ↗
GitHub PoC
Reproducer for CVE-2026-40859 — Apache Camel camel-netty-http / camel-vertx-http producer-side unsafe deserialization of HTTP response bodies (RCE)
CVE-2026-40859HIGH10 jul 2026
Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled
21RIESGO
abrir ↗
GitHub PoC
CVE-2025-60787 motionEye authenticated command injection RCE PoC
CVE-2025-60787HIGH10 jul 2026
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name
61RIESGO
abrir ↗
GitHub PoC
Abyssal is a high-performance Telnet vulnerability scanner for CVE-2026-24061, delivering root shells on vulnerable systems with false-positive detection.
CVE-2026-24061CRITICALbajo ataque10 jul 2026
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RIESGO
abrir ↗
GitHub PoC
sudoand3rs0n/CVE-2025-5548
CVE-2025-5548MEDIUM10 jul 2026
FreeFloat FTP Server NOOP Command buffer overflow
38RIESGO
abrir ↗
GitHub PoC
Reproducer for CVE-2026-40860 — Apache Camel camel-jms/sjms/amqp JMS ObjectMessage unsafe deserialization (RCE)
CVE-2026-40860CRITICAL10 jul 2026
Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp
48RIESGO
abrir ↗
GitHub PoC★ 1
Reproducer for CVE-2026-40858 — Apache Camel camel-infinispan remote aggregation repository unsafe deserialization (RCE)
CVE-2026-40858HIGH10 jul 2026
Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository
41RIESGO
abrir ↗
GitHub PoC
CVE-2026-28992 IOHIDFamily FastPathUserClient race condition PoC — security research
CVE-2026-28992MEDIUM10 jul 2026
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7
33RIESGO
abrir ↗
GitHub PoC
caspy123/CVE-2026-43499
CVE-2026-43499HIGH10 jul 2026
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗
GitHub PoC★ 1
inforcqb/CVE-2026-43499-pja110
CVE-2026-43499HIGH10 jul 2026
rtmutex: Use waiter::task instead of current in remove_waiter()
41RIESGO
abrir ↗
GitHub PoC
CVE-2026-51833 Advisory
CVE-2026-51833HIGH10 jul 2026
Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can
41RIESGO
abrir ↗
GitHub PoC
0x77FSec/CVE-2026-23744
CVE-2026-23744CRITICAL10 jul 2026
REC in MCPJam inspector due to HTTP Endpoint exposes
75RIESGO
abrir ↗
← anteriorpágina 35 / 478siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.