Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados

36.206CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientes populares riesgo

14.316 exploits

GitHub PoC

Defensive lab validation and SOC detection guidance for CVE-2026-48907 in Joomla JCE <= 2.9.99.4, including Apache/Joomla/auditd telemetry, webshell artifacts, Sigma rules, MITRE ATT&CK mapping and mitigation recommendations.

CVE-2026-48907CRITICALbajo ataque18 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

GitHub PoC★ 4

Detection scripts, patch checker & hardening guide for CVE-2026-44963 (Veeam B&R RCE)

CVE-2026-44963CRITICAL18 jun 2026

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

48RIESGO

GitHub PoC

A PoC/exploit written in python for the unauthenticated SQL injection vulnerability CVE-2026-3359 situated within Form Maker (version <= 1.15.42) by 10Web.

CVE-2026-3359HIGH18 jun 2026

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'

41RIESGO

GitHub PoC★ 1

Unauthenticated Local File Inclusion

CVE-2026-7515CRITICAL18 jun 2026

BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style

48RIESGO

GitHub PoC★ 9

CVE-2026-50656

CVE-2026-50656HIGH18 jun 2026

Microsoft Defender Elevation of Privilege Vulnerability

46RIESGO

GitHub PoC

A local lab for studying, reproducing, and verifying the patch for CVE-2026-42208: an unauthenticated SQL injection in LiteLLM's API key authentication path.

CVE-2026-42208CRITICALbajo ataque18 jun 2026

LiteLLM: SQL injection in Proxy API key verification

100RIESGO

GitHub PoC★ 1

CVE-2026-40369

CVE-2026-40369HIGH18 jun 2026

Windows Kernel Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC★ 11

0xCyberstan/CVE-2026-46215-POC

CVE-2026-46215HIGH18 jun 2026

drm: Set old handle to NULL before prime swap in change_handle

41RIESGO

GitHub PoC★ 1

Unauthenticated RCE exploit for Veritas Backup Exec Agent (CVE-2021-27876/77/78) — SHA auth bypass to SYSTEM via NDMP

CVE-2021-27876HIGHbajo ataqueransomware18 jun 2026

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires suc

91RIESGO

GitHub PoC

CVE-2025-6254 — Doctreat Core <= 1.6.8 — Unauthenticated Privilege Escalation

CVE-2025-6254CRITICAL18 jun 2026

Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation

48RIESGO

GitHub PoC

Authenticated Remote Code Execution via loadReader functionName code injection in DbGate

CVE-2026-47670CRITICAL18 jun 2026

DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

63RIESGO

GitHub PoC★ 1

CVE-2026-38165 (SSTI)

CVE-2026-38165CRITICAL18 jun 2026

A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2

48RIESGO

GitHub PoC

CVE-2026-45777 PoC

CVE-2026-45777CRITICAL17 jun 2026

Open XDMoD Vulnerable to Unauthenticated Remote Code Execution (RCE) via OS Command Injection

28RIESGO

GitHub PoC

CVE-2026-49085 WP Insightly PHP Object Injection Exploit

CVE-2026-49085CRITICAL17 jun 2026

WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

48RIESGO

GitHub PoC

CVE-2026-49104 Integration for Keap/Infusionsoft PHP Object Injection Exploit

CVE-2026-49104CRITICAL17 jun 2026

WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability

48RIESGO

GitHub PoC★ 1

CVE-2026-20262 - Cisco Catalyst SD-WAN Manager Arbitrary File Write Path Traversal Vulnerability (CWE-22) - Authenticated Remote File Write

CVE-2026-20262MEDIUMbajo ataque17 jun 2026

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

68RIESGO

GitHub PoC

CVE-2026-5411 WP Captcha PRO

CVE-2026-5411HIGH17 jun 2026

WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

41RIESGO

GitHub PoC

CVE-2026-49079 JetSearch SQL Injection Exploit

CVE-2026-49079CRITICAL17 jun 2026

WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

48RIESGO

GitHub PoC

Write-ups from completed TryHackMe rooms — Linux privilege escalation, sudo buffer overflow (CVE-2019-18634), and OWASP Top 10 (2025).

CVE-2019-18634—17 jun 2026

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the

28RIESGO

GitHub PoC

CVE-2026-42758 WebinarIgnition Exploit

CVE-2026-42758CRITICAL17 jun 2026

WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability

48RIESGO

GitHub PoC

mandeepsohal/CVE-2025-66391

CVE-2025-66391HIGH17 jun 2026

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o

41RIESGO

GitHub PoC

CVE-2026-7459 Simple History Missing Authorization Account Takeover Exploit

CVE-2026-7459HIGH17 jun 2026

Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint

41RIESGO

GitHub PoC

rootdirective-sec/CVE-2026-49060-Lab

CVE-2026-49060CRITICAL17 jun 2026

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

48RIESGO

GitHub PoC

CVE-2026-39808 - Fortinet Sandbox - Draft

CVE-2026-39808CRITICALbajo ataque17 jun 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

100RIESGO

GitHub PoC

CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit

CVE-2026-7654HIGH17 jun 2026

Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

41RIESGO

GitHub PoC

akpmarcelin/CVE-2026-24061-lab

CVE-2026-24061CRITICALbajo ataque17 jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

GitHub PoC

CVE-2026-48907

CVE-2026-48907CRITICALbajo ataque17 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

GitHub PoC

Exploitation and mitigation analysis of CVE-2021-3156 heap-based buffer overflow in sudo

CVE-2021-3156HIGHbajo ataque17 jun 2026

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

GitHub PoC★ 21

CVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory

CVE-2026-36425MEDIUM17 jun 2026

An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user

33RIESGO

GitHub PoC★ 141

PACKET_EDIT_MEME.c (aka CVE-2026-46331): yet another page cache poisoning nightmare

CVE-2026-46331HIGH17 jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.