Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.959exploits catalogados

36.206CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4358Metasploit 3489✓ solo verificadosrecientes populares riesgo

14.316 exploits

GitHub PoC

mandeepsohal/CVE-2025-66391

CVE-2025-66391HIGH17 jun 2026

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-39808 - Fortinet Sandbox - Draft

CVE-2026-39808CRITICALbajo ataque17 jun 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-39813 - Fortinet Sandbox - Draft

CVE-2026-39813CRITICAL17 jun 2026

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.

53RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2015-10141 – Xdebug unauthenticated RCE

CVE-2015-10141CRITICAL17 jun 2026

Xdebug Remote Debugger Unauthenticated OS Command Execution

63RIESGO

abrir ↗

GitHub PoC

CVE-2026-7459 Simple History Missing Authorization Account Takeover Exploit

CVE-2026-7459HIGH17 jun 2026

Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-48907

CVE-2026-48907CRITICALbajo ataque17 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

abrir ↗

GitHub PoC

d4ngkh04w/CVE-2020-7961

CVE-2020-7961CRITICALbajo ataque17 jun 2026

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems

CVE-2026-48907CRITICALbajo ataque17 jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-49083 LatePoint Calendar Booking Plugin Privilege Escalation Exploit

CVE-2026-49083HIGH17 jun 2026

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-5415 WP Captcha PRO Authenticated Authentication Bypass Exploit

CVE-2026-5415HIGH17 jun 2026

WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit

CVE-2026-7654HIGH17 jun 2026

Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

41RIESGO

abrir ↗

GitHub PoC

87achrafg-stack/CVE-2026-49083

CVE-2026-49083HIGH17 jun 2026

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

41RIESGO

abrir ↗

GitHub PoC

akpmarcelin/CVE-2026-24061-lab

CVE-2026-24061CRITICALbajo ataque17 jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RIESGO

abrir ↗

GitHub PoC★ 3

Chaining Security Bugs in Discuz! X5.0: from Race Condition to Pre-Auth RCE

CVE-2026-49952CRITICAL17 jun 2026

Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle

63RIESGO

abrir ↗

GitHub PoC

CVE-2026-49105 WP Zendesk PHP Object Injection Exploit

CVE-2026-49105CRITICAL17 jun 2026

WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-49079 JetSearch SQL Injection Exploit

CVE-2026-49079CRITICAL17 jun 2026

WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

48RIESGO

abrir ↗

GitHub PoC

The project documents the completion and analysis of the Fragnesia (CVE-2026-46300) TryHackME lab, which demonstrates a Linux kernel page -cache corruption vulnerability capable of achieving local privilege escalation through modification of cached file pages without altering files on disk.

CVE-2026-46300HIGH17 jun 2026

net: skbuff: preserve shared-frag marker during coalescing

56RIESGO

abrir ↗

GitHub PoC★ 21

CVE-2026-36425 OPSWAT AppRemover (ardrv.sys) improper access control advisory

CVE-2026-36425MEDIUM17 jun 2026

An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user

33RIESGO

abrir ↗

GitHub PoC

Self-contained Docker reproduction and analysis of CVE-2024-23897, the Jenkins CLI arbitrary file read via the args4j @-syntax argument expansion.

CVE-2024-23897CRITICALbajo ataqueransomware16 jun 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RIESGO

abrir ↗

GitHub PoC

KovachVL/CVE-2026-55168

CVE-2026-55168MEDIUM16 jun 2026

Runtipi: Authenticated arbitrary file write via backup restore symlink planting

33RIESGO

abrir ↗

GitHub PoC

CVE-2025-49844 exploit script

CVE-2025-49844CRITICAL16 jun 2026

Redis Lua Use-After-Free may lead to remote code execution

85RIESGO

abrir ↗

GitHub PoC

right payload for java CVE

CVE-2025-24813CRITICALbajo ataque16 jun 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-47101, CVE-2026-47102, CVE-2026-40217

CVE-2026-47101HIGH16 jun 2026

LiteLLM < 1.83.14 Privilege Escalation via API Key Generation

41RIESGO

abrir ↗

GitHub PoC★ 1

PoC exploit for CVE-2025-55182 (React2Shell) — Pre-auth RCE in React Server Components | CVSS 10.0

CVE-2025-55182CRITICALbajo ataqueransomware16 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC★ 1

Mass Scanner For Drupal Exploit CVE-2026-9082

CVE-2026-9082CRITICALbajo ataque16 jun 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

100RIESGO

abrir ↗

GitHub PoC

Penetration testing assessment of a vulnerable IIS 6.0 WebDAV server, demonstrating reconnaissance, enumeration, exploitation (CVE-2017-7269), and privilege escalation to SYSTEM, along with risk analysis and remediation strategies.

CVE-2017-7269CRITICALbajo ataque16 jun 2026

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in

100RIESGO

abrir ↗

GitHub PoC

Saku0512/CVE-2026-54686-poc

CVE-2026-54686MEDIUM16 jun 2026

Warp: DCS lifecycle hook spoofing can alter terminal session metadata

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-50751 Mass Scanner

CVE-2026-50751CRITICALbajo ataqueransomware16 jun 2026

User Authentication Bypass in VPN Remote Access and Mobile Access

100RIESGO

abrir ↗

GitHub PoC

This is an exploit poc for CVE-2026-4480

CVE-2026-4480CRITICAL16 jun 2026

Samba: samba: remote code execution in printing subsystem via unescaped job description

68RIESGO

abrir ↗

GitHub PoC★ 7

Manage and recover BitLocker encrypted drives with this tool for Windows 11 recovery key management and educational study of CVE-2026-45585.

CVE-2026-45585MEDIUM16 jun 2026

Windows BitLocker Security Feature Bypass Vulnerability

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.