Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.200 exploits

GitHub PoC

risorse di ricerca per cve-2026-7228

CVE-2026-7228MEDIUM24 jul 2026

SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection

33RIESGO

abrir ↗

GitHub PoC

Pedit COW – Linux Kernel Local Privilege Escalation (CVE-2026-46331)

CVE-2026-46331HIGH24 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

abrir ↗

GitHub PoC

WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi (CVE-2026-63030 + CVE-2026-60137)

CVE-2026-63030CRITICALbajo ataque24 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

abrir ↗

GitHub PoC★ 1

EasyStore Joomla Pre-Auth SQL Injection via filter_sortby Direction (CVE-2026-65761, CVSS 9.3)

CVE-2026-65761CRITICAL24 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1

63RIESGO

abrir ↗

GitHub PoC★ 1

React2Shell is a proof-of-concept exploit for CVE-2025-55182 affecting vulnerable React Server Components (RSC) implementations in Next.js

CVE-2025-55182CRITICALbajo ataqueransomware24 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

Proof of Concept for CVE-2026-9198 - IBM Langflow Unauthenticated RCE via Auto-Login Bypass

CVE-2026-9198CRITICALbajo ataque24 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RIESGO

abrir ↗

GitHub PoC

blue-chocolates/CVE-2016-10033

CVE-2016-10033CRITICALbajo ataque24 jul 2026

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RIESGO

abrir ↗

GitHub PoC

Security Advisory: Infinite Loop DoS in facil.io MIME Parser (Partial Boundary)

CVE-2026-66730HIGH24 jul 2026

facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser

41RIESGO

abrir ↗

GitHub PoC

Lite-os15/Lab-001-Gitea-CVE-2026-20896-

CVE-2026-20896CRITICAL24 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RIESGO

abrir ↗

GitHub PoC

Security Advisory: Negative Chunk-Size Parsing Causes Memory Corruption in facil.io

CVE-2026-66731HIGH24 jul 2026

facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS

41RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-60206

CVE-2026-60206CRITICAL24 jul 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

48RIESGO

abrir ↗

GitHub PoC

is an advanced security research framework designed to model, analyze, and demonstrate Local Privilege Escalation (LPE) mechanics associated with kernel-level race conditions and filesystem structure vulnerabilities (CVE-2026-64600 / RefluXFS)

CVE-2026-64600HIGH24 jul 2026

xfs: resample the data fork mapping after cycling ILOCK

41RIESGO

abrir ↗

GitHub PoC★ 35

cve cve-2026-60206 weblogic saml exploit poc vulnerability oracle scanner security

CVE-2026-60206CRITICAL24 jul 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

48RIESGO

abrir ↗

GitHub PoC★ 4

CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework | Bash & Python versions. Features: --detect safe check, --exploit combo/unsigned/xsw/nameid/all, --shodan integration, --tor support, mass scanning, JSON/CSV/JSONL output, cookie validation. CVSS 9.9 Critical - Use Ethically, Stay Legal.

CVE-2026-60206CRITICAL24 jul 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

48RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-41940

CVE-2026-41940CRITICALbajo ataqueransomware24 jul 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RIESGO

abrir ↗

GitHub PoC★ 1

Security Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field

CVE-2026-66748HIGH24 jul 2026

Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

41RIESGO

abrir ↗

GitHub PoC

ange-primiterra/CVE-2026-47761

CVE-2026-47761HIGH24 jul 2026

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

41RIESGO

abrir ↗

GitHub PoC

manfredgabriel/cve-2021-43798-lab

CVE-2021-43798HIGHbajo ataque24 jul 2026

Grafana path traversal

100RIESGO

abrir ↗

GitHub PoC

sbimoxa/cve-2021-43798-lab

CVE-2021-43798HIGHbajo ataque24 jul 2026

Grafana path traversal

100RIESGO

abrir ↗

GitHub PoC★ 1

Flowise Windows RCE exploit for CVE-2026-58057. Bypasses environment variable validation via case-sensitive flaw. Uses node_options to inject arbitrary code through MCP stdio. Supports reverse shell, persistence, file upload, credential dumping. For authorized security testing only.

CVE-2026-58057LOW23 jul 2026

Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity

28RIESGO

abrir ↗

GitHub PoC

Tproot es una máquina de nivel Muy Fácil de DockerLabs centrada en la explotación manual del servicio vsftpd 2.3.4 (CVE-2011-2523).

CVE-2011-2523—23 jul 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

abrir ↗

GitHub PoC

theeomega/CVE-2025-32432-POC

CVE-2025-32432CRITICALbajo ataque23 jul 2026

Craft CMS Allows Remote Code Execution

100RIESGO

abrir ↗

GitHub PoC★ 465

Android complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel, combination of CVE-2026-49881 and CVE-2026-43284

CVE-2026-49881HIGH23 jul 2026

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the

41RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-64560, kernelctf-lts-6.12.95

CVE-2026-64560HIGH23 jul 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RIESGO

abrir ↗

GitHub PoC★ 5

CVE-2026-43499 exploit configuration for realme RMX3888 (Android 16) - 20 verified kernel offsets

CVE-2026-43499HIGH23 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

GitHub PoC

Security analysis and report of CVE-2024-6387 OpenSSH vulnerability, including vulnerability details, CVSS evaluation, and mitigation recommendations.

CVE-2024-6387HIGH23 jul 2026

Openssh: regresshion - race condition in ssh allows rce/dos

63RIESGO

abrir ↗

GitHub PoC★ 1

Metabase CVE-2026-59827 Vulnerability Scanner

CVE-2026-59827CRITICAL23 jul 2026

Metabase: Unsafe Deserialization of H2 Query Results

48RIESGO

abrir ↗

GitHub PoC

finding by nvth

CVE-2026-59880HIGH23 jul 2026

Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

21RIESGO

abrir ↗

GitHub PoC

Legacy HPE iMC vuln

CVE-2019-5392—23 jul 2026

A disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than ve

23RIESGO

abrir ↗

GitHub PoC

CVE Reproduction: cve-2025-5777-citrixbleed2_reproduction

CVE-2025-5777CRITICALbajo ataqueransomware23 jul 2026

NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.