Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.200 exploits

GitHub PoC★ 27

Technical analysis and Proof-of-Concept (PoC) for CVE-2026-41089, a critical unauthenticated Remote Code Execution (RCE) vulnerability in the Windows Netlogon service affecting Domain Controllers.

CVE-2026-41089CRITICAL21 jul 2026

Windows Netlogon Remote Code Execution Vulnerability

48RIESGO

GitHub PoC

Drop-in fix for the unpatched MCP STDIO command-injection flaw (CVE-2026-30623 family)

CVE-2026-30623CRITICAL21 jul 2026

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application

63RIESGO

GitHub PoC

WhatsWrongAndWhy/CVE-2018-5333

CVE-2018-5333—21 jul 2026

In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning

38RIESGO

GitHub PoC

WhatsWrongAndWhy/CVE-2021-22555

CVE-2021-22555HIGHbajo ataque21 jul 2026

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

100RIESGO

GitHub PoC

PoC reproducer for CVE-2026-49099 (Apache Camel camel-salesforce): the non-Camel-prefixed sObjectQuery header escapes the HTTP header filter and overrides the producer's configured SOQL (SOQL injection / broken access control). Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-49099MEDIUM21 jul 2026

Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

33RIESGO

GitHub PoC

my exploit for GLPI

CVE-2022-35914CRITICALbajo ataque21 jul 2026

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RIESGO

GitHub PoC

WhatsWrongAndWhy/CVE-2017-1000112

CVE-2017-1000112—21 jul 2026

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE

43RIESGO

GitHub PoC

danielissaq/-PaperCut-CVE-2023-27350-

CVE-2023-27350CRITICALbajo ataqueransomware21 jul 2026

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui

100RIESGO

GitHub PoC

WhatsWrongAndWhy/CVE-2018-18955

CVE-2018-18955—21 jul 2026

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat

38RIESGO

GitHub PoC★ 4

Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030

CVE-2026-60137MEDIUMbajo ataque21 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RIESGO

GitHub PoC★ 1

PoC for CVE-2026-57588 - SQL injection in Nessus 10.12.0 XML import. Generates malicious .nessus files to enumerate databases, exfiltrate credentials, and test time-based blind injection. For authorized security research. Author: Sudeepa Wanigarathna. Patched in 10.12.1.

CVE-2026-57588LOW21 jul 2026

SQL Injection in Nessus via Malicious Scan Result File Import

28RIESGO

GitHub PoC★ 1

PoC reproducer for CVE-2026-53913 (Apache Camel camel-keycloak): KeycloakSecurityPolicy fails open in the Basic Setup — with no required roles/permissions the token is never verified, so any forged/garbage bearer token bypasses authentication (unauthenticated RCE). Fixed in 4.18.3/4.21.0.

CVE-2026-53913CRITICAL21 jul 2026

Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted

48RIESGO

GitHub PoC

mass_cve-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware21 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

GitHub PoC

Mofarthim/CVE-2026-50369

CVE-2026-50369HIGH21 jul 2026

Windows Remote Desktop Services Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC★ 1

CVE-2026-6875

CVE-2026-6875CRITICAL21 jul 2026

Sandbox Escape in ServiceNow AI Platform

63RIESGO

GitHub PoC

WhatsWrongAndWhy/CVE-2017-7308

CVE-2017-7308—21 jul 2026

The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer

43RIESGO

GitHub PoC

Tracking the nginx CVE-2026-42533 map/regex capture-clobbering heap overflow

CVE-2026-42533CRITICAL21 jul 2026

NGINX Map directive and Regex matching vulnerability

48RIESGO

GitHub PoC

PoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion) + CVE-2026-60137 (author__not_in SQL injection). For authorized security testing only.

CVE-2026-63030CRITICALbajo ataque21 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

CVE-2026-13233 (Drupal OpenAI Provider, SA-CONTRIB-2026-053): response-URL SSRF / local file read. Untrusted upstream, not the prompt. Safe reproducer + detections. Fixed in 1.1.1/1.2.2.

CVE-2026-13233LOW21 jul 2026

OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

28RIESGO

GitHub PoC

PoC reproducer for CVE-2026-49365 (Apache Camel camel-netty-http / camel-undertow): muteException defaults to false, so an uncaught exception's full Java stack trace is returned to the HTTP client (CWE-209). Fixed in 4.14.8/4.18.3/4.21.0.

CVE-2026-49365MEDIUM21 jul 2026

Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients

33RIESGO

GitHub PoC★ 5

Exploit, POC for CVE-2025-32432, CraftCMS2Shell

CVE-2025-32432CRITICALbajo ataque21 jul 2026

Craft CMS Allows Remote Code Execution

100RIESGO

GitHub PoC

0xdak/CVE-2026-53595_exploit

CVE-2026-53595CRITICAL21 jul 2026

FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

63RIESGO

GitHub PoC★ 1

0xdak/CVE-2026-9198_exploit

CVE-2026-9198CRITICALbajo ataque21 jul 2026

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

98RIESGO

GitHub PoC

CVE-2026-13156 Vulnerability Advisory & PoC — Discovered by Huynh Kien Minh (MinhHK).

CVE-2026-13156MEDIUM21 jul 2026

MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF

33RIESGO

GitHub PoC★ 1

PoC toolkit for exploiting Cisco IMC RCE CVE-2026-20200

CVE-2026-20200HIGH21 jul 2026

Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability

41RIESGO

GitHub PoC★ 1

Hashes and shim versions for the UEFI Secure Boot shims affected by CVE-2026-8863

CVE-2026-8863HIGH21 jul 2026

CVE-2026-8863

41RIESGO

GitHub PoC

CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)

CVE-2026-60137MEDIUMbajo ataque21 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RIESGO

GitHub PoC

unauthenticated RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137)

CVE-2026-63030CRITICALbajo ataque20 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

Dungsocool/CVE-2024-23897

CVE-2024-23897CRITICALbajo ataqueransomware20 jul 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RIESGO

GitHub PoC

Reproducer for CVE-2026-48206: Apache Camel camel-jira IssueKey (and other non-Camel-prefixed) header injection driving arbitrary JIRA issue operations with the endpoint's service-account credentials (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48206MEDIUM20 jul 2026

Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured credentials

33RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.