Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.655exploits catalogados

39.248CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.347Exploit-DB 24.485GitHub PoC 16.178VulnCheck XDB 9644Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.178 exploits

GitHub PoC

CVE-2015-5287

CVE-2015-5287HIGHbajo ataque27 ago 2026

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain perm

86RIESGO

abrir ↗

GitHub PoC★ 22

Metabase SQLi

CVE-2026-72898CRITICALbajo ataque27 ago 2026

Metabase SQL injection via password reset endpoint

100RIESGO

abrir ↗

GitHub PoC★ 3

A Python-based exploitation framework for CVE-2026-75604 that enables authorized penetration testers to validate Next.js Windows cache traversal vulnerabilities. Deploys reverse shells and webshells via path traversal, with built-in target verification and proxy support for seamless integration into standard pentest workflows.

CVE-2026-75604CRITICAL27 ago 2026

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

63RIESGO

abrir ↗

GitHub PoC★ 1

Oracle WebLogic Console unauthenticated auth bypass + RCE exploit (CVE-2020-14882 / CVE-2020-14750)

CVE-2020-14882CRITICALbajo ataque27 ago 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RIESGO

abrir ↗

GitHub PoC

SneakyNachos/CVE-2026-74936-gc-potato

CVE-2026-74936CRITICAL27 ago 2026

Use-after-free in the JavaScript: WebAssembly component

48RIESGO

abrir ↗

GitHub PoC

A scanner for CVE-2026-55040 and CVE-2026-63520, designed to determine whether the server is affected by these two CVEs.

CVE-2026-55040CRITICALbajo ataque27 ago 2026

Microsoft SharePoint Server Security Feature Bypass Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-18431 - Draft or TODO

CVE-2026-18431CRITICAL27 ago 2026

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-77542, CVE-2026-77543, CVE-2026-77545, CVE-2026-77550, CVE-2026-77551, CVE-2026-77552, CVE-2026-77553, CVE-2026-77554, CVE-2026-77557 - Draft or TODO

CVE-2026-77542CRITICAL27 ago 2026

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit

48RIESGO

abrir ↗

GitHub PoC★ 1

sahmsec/CVE-2026-32475

CVE-2026-32475CRITICAL27 ago 2026

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

63RIESGO

abrir ↗

GitHub PoC

CVE-2026-55040

CVE-2026-55040CRITICALbajo ataque27 ago 2026

Microsoft SharePoint Server Security Feature Bypass Vulnerability

100RIESGO

abrir ↗

GitHub PoC

Hack The Box Connected machine write-up featuring enumeration, CVE-2025-57819 exploitation, reverse shell, and privilege escalation to root via FreePBX and incron.

CVE-2025-57819CRITICALbajo ataque27 ago 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-20303, CVE-2026-20304, CVE-2026-20310, CVE-2026-20312, CVE-2026-20313

CVE-2026-20303CRITICAL27 ago 2026

Cisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities

48RIESGO

abrir ↗

GitHub PoC

Gvln-S/CVE-2011-2523

CVE-2011-2523—27 ago 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

abrir ↗

GitHub PoC

Writeup + CVE analysis + countermeasures for the Hacktivity 'Vulnerabilities, Exploits, and Remote Access Payloads' lab (netcat shells, Metasploit, CVE-2010-1240, CVE-2004-2687).

CVE-2010-1240—27 ago 2026

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of

60RIESGO

abrir ↗

GitHub PoC

Hunt-Benito/the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

CVE-2026-67602CRITICAL27 ago 2026

phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache

48RIESGO

abrir ↗

GitHub PoC

For educational purposes

CVE-2026-65351MEDIUM27 ago 2026

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS

33RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detector

CVE-2026-18963CRITICAL27 ago 2026

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

63RIESGO

abrir ↗

GitHub PoC

Minimal reproduction for Spring AI ParagraphManager sibling self-loop OOM (incomplete fix of CVE-2026-47851)

CVE-2026-47851HIGH27 ago 2026

Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

21RIESGO

abrir ↗

GitHub PoC

t3bik/CVE-2026-75898

CVE-2026-75898HIGH26 ago 2026

RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

41RIESGO

abrir ↗

GitHub PoC

mohamedjawady/CVE-2026-53613-poc

CVE-2026-53613HIGH26 ago 2026

util-linux mount target TOCTOU allows local privilege escalation

41RIESGO

abrir ↗

GitHub PoC★ 4

Zimbra SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP exploit (Poc)

CVE-2026-73570HIGHbajo ataque26 ago 2026

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

100RIESGO

abrir ↗

GitHub PoC

Poc CVE-2026-18080

CVE-2026-18080CRITICAL26 ago 2026

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment

48RIESGO

abrir ↗

GitHub PoC

zenzue/CVE-2026-55040

CVE-2026-55040CRITICALbajo ataque26 ago 2026

Microsoft SharePoint Server Security Feature Bypass Vulnerability

100RIESGO

abrir ↗

GitHub PoC

KongQBin/CVE-2016-5195

CVE-2016-5195HIGHbajo ataque26 ago 2026

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RIESGO

abrir ↗

GitHub PoC★ 1

PostGIS SQL Injection GeoTools

CVE-2026-76904CRITICAL26 ago 2026

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

63RIESGO

abrir ↗

GitHub PoC

CVE-2026-56705 — Adminer < 5.4.3 Unauthenticated RCE via MSSQL PDO DSN Injection

CVE-2026-56705CRITICAL26 ago 2026

Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

48RIESGO

abrir ↗

GitHub PoC

ksotaria1337/-CVE-2026-48907-

CVE-2026-48907CRITICALbajo ataque26 ago 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

98RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing

CVE-2026-75604CRITICAL26 ago 2026

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

63RIESGO

abrir ↗

GitHub PoC

Threat model and vulnerability analysis of Contec SolarView Compact (CVE-2022-29303)

CVE-2022-29303CRITICALbajo ataque26 ago 2026

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

100RIESGO

abrir ↗

GitHub PoC

Authorized education-sector recon & triage orchestrator (nmap/dirsearch/sqlmap/hydra + CVE-2024-4577, secret/API-key leak, XSS, wp2shell) with a web control panel

CVE-2024-4577CRITICALbajo ataqueransomware26 ago 2026

Argument Injection in PHP-CGI

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.