Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

80.095exploits catalogados

36.945CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.476Referência 23.442GitHub PoC 15.312VulnCheck XDB 8970Nuclei 4393Metasploit 3502✓ solo verificadosrecientes populares riesgo

80.095 exploits

GitHub PoC★ 1

CVE-2026-50181 / GHSA-fg23-3346-88f5: Langroid path traversal advisory landing page

CVE-2026-50181HIGH09 jul 2026

Langroid: Path traversal in the file tools allows read/write outside configured current directory

41RIESGO

abrir ↗

GitHub PoC★ 9

tc3650/CVE-2026-43499-armv7

CVE-2026-43499HIGH09 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2025-24893CRITICALbajo ataque09 jul 2026

Remote code execution as guest via SolrSearchMacros request in xwiki

100RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-50131 / GHSA-xw9q-2mv6-9fr8: Fedify incomplete SSRF mitigation advisory landing page

CVE-2026-50131HIGH09 jul 2026

Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

41RIESGO

abrir ↗

GitHub PoC

Control Web Panel (CWP) vulnerability scenario related to CVE-2026-57517

CVE-2026-57517CRITICAL09 jul 2026

Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

48RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-4257 - Contact Form by Supsystic <= 1.7.36 # SSTI to RCE

CVE-2026-4257CRITICAL09 jul 2026

Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality

75RIESGO

abrir ↗

GitHub PoC

endusdksla/xwiki-cve-2025-24893

CVE-2025-24893CRITICALbajo ataque09 jul 2026

Remote code execution as guest via SolrSearchMacros request in xwiki

100RIESGO

abrir ↗

GitHub PoC

unpredictable21/halo-2.25.4-CVE-2026-67919

CVE-2026-67919CRITICAL09 jul 2026

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri m

48RIESGO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-40473: Apache Camel camel-mina MinaConverter.toObjectInput unsafe deserialization (RCE over TCP/UDP)

CVE-2026-40473HIGH09 jul 2026

Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP

41RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-53359漏洞补丁

CVE-2026-53359HIGH09 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RIESGO

abrir ↗

GitHub PoC

johnwickakash12/CVE-2021-41773

CVE-2021-41773HIGHbajo ataqueransomware09 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

GitHub PoC★ 1

0x00phantom-hat/CVE-2026-12400-Exploit

CVE-2026-12400MEDIUM09 jul 2026

FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints

33RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2026-49230: Apache APISIX jwe-decrypt authentication bypass (missing AES-GCM tag validation, CWE-354, CVSS 9.1)

CVE-2026-49230MEDIUM09 jul 2026

Apache APISIX: Authentication bypass in jwe-decrypt

33RIESGO

abrir ↗

GitHub PoC

Laboratory validation of CVE-2026-48908 in Joomla SP Page Builder, covering unauthorized icon upload, PHP file write, code execution as www-data, auditd and PCAP evidence, event timeline reconstruction, and SOC detection recommendations. Includes Polish and English reports.

CVE-2026-48908CRITICAL09 jul 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

68RIESGO

abrir ↗

GitHub PoC★ 1

Offical PoC for this cve

CVE-2026-56876HIGH09 jul 2026

extract-zip unvalidated symlink path traversal

41RIESGO

abrir ↗

GitHub PoC

包括能执行的命令探测和一键getshell（需要服务器部署服务）

CVE-2026-8037CRITICALbajo ataque09 jul 2026

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

100RIESGO

abrir ↗

GitHub PoC

CVE-2026-50746... - Draft

CVE-2026-50746CRITICAL09 jul 2026

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Conne

48RIESGO

abrir ↗

GitHub PoC

Public disclosure for CVE-2026-52100 (CSRF) & CVE-2026-52101 (SSRF) in linx-server. MITRE assigned the CVEs; this repo provides a public reference and helps affected users understand the risk.

CVE-2026-52100HIGH09 jul 2026

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to e

41RIESGO

abrir ↗

GitHub PoC

Librebooking Admin RCE PoC CVE-2026-61343

CVE-2026-61343HIGH09 jul 2026

LibreBooking path traversal

41RIESGO

abrir ↗

GitHub PoC

Automated exploit for Krayin CRM ≤ 2.2.x.

CVE-2026-38526CRITICAL08 jul 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

abrir ↗

GitHub PoC

eunho87/CVE-2021-42013

CVE-2021-42013CRITICALbajo ataqueransomware08 jul 2026

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RIESGO

abrir ↗

Exploit-DB

Joomla Page Builder CK 3.5.10 - Arbitrary File Upload

CVE-2026-56290CRITICALwebappsmultiple08 jul 2026

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

75RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-56290CRITICAL08 jul 2026

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

75RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-24706CRITICALbajo ataque08 jul 2026

Remote Code Execution Vulnerability in Packaging

100RIESGO

abrir ↗

GitHub PoC★ 5

CVE-2026-56290 - Mass Exploit for Joomla Com_pagebuilderck component (Unrestricted File Upload → RCE). Multi-threaded, automatic CSRF bypass, PHP shell uploader.

CVE-2026-56290CRITICAL08 jul 2026

Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0

75RIESGO

abrir ↗

Exploit-DB

Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure

CVE-2025-60188HIGHwebappsmultiple08 jul 2026

WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability

56RIESGO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-40048: Apache Camel camel-pqc FileBasedKeyLifecycleManager unsafe deserialization (RCE)

CVE-2026-40048HIGH08 jul 2026

Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

41RIESGO

abrir ↗

GitHub PoC

Reproducer for CVE-2026-40453: Apache Camel case-variant Camel header injection (incomplete fix of CVE-2025-27636)

CVE-2026-40453CRITICAL08 jul 2026

Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

48RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-19874

CVE-2026-19874CRITICAL08 jul 2026

Konami's Metal Gear Online 3 contains a heap-based buffer overflow

48RIESGO

abrir ↗

GitHub PoC

Exploit for CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware08 jul 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.