Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.735exploits catalogados

39.316CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.394Exploit-DB 24.485GitHub PoC 16.207VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.208 exploits

GitHub PoC★ 64

Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

Non-intrusive checker for CVE-2026-63030 / CVE-2026-60137 ("wp2shell"), a pre-authentication RCE chain in WordPress core.

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

CVE-2026-48939CRITICALbajo ataque18 jul 2026

Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

98RIESGO

GitHub PoC★ 10

CVE-2026-63030 (wp2shell) POC.

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC★ 1

A critical unauthenticated "remote code execution" vulnerability affecting WordPress Core

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

Lightweight scanner that detects vulnerable Log4j versions and Log4Shell (CVE-2021-44228) indicators in a filesystem tree.

CVE-2021-44228CRITICALbajo ataqueransomware18 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC★ 9

CVE-2026-63030 (RCE) + CVE-2026-60137 (SQLi)

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

akash-osmsec/CVE-2026-44262-

CVE-2026-44262CRITICAL18 jul 2026

Scramble: Remote code execution via evaluation of user-controlled input in validation rules

63RIESGO

GitHub PoC★ 6

wp2shell - WordPress CVE-2026-63030 Exploit & Scanner

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

wp2shell (CVE-2026-60137 / CVE-2026-63030)

CVE-2026-60137MEDIUMbajo ataque18 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RIESGO

GitHub PoC★ 115

CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

tcyph3r/wp2shell-cve-2026-63030-root-cause

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.

CVE-2026-60137MEDIUMbajo ataque18 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RIESGO

GitHub PoC★ 10

wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.

CVE-2026-60137MEDIUMbajo ataque18 jul 2026

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

78RIESGO

GitHub PoC

Hunt-Benito/zephyr-lwm2m-firmware-update-oob-read-cve-2026-10672-truncated-package-uri

CVE-2026-10672HIGH18 jul 2026

Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

41RIESGO

GitHub PoC★ 4

Abdal CVE-2026-63030 is a professional WordPress vulnerability scanner designed to detect exposure to CVE-2026-63030 through version analysis and REST API security checks. Developed by Ebrahim Shafiei (EbraSha) for cybersecurity research, penetration testing, and WordPress security assessment.

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC★ 15

WordPress 未授权RCE EXP | CVE-2026-63030

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

ret2bilibili/CVE-2026-14266

CVE-2026-14266HIGH18 jul 2026

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

41RIESGO

GitHub PoC★ 6

A scanner and proof-of-concept toolkit for CVE-2026-63030 (wp2shell) - pre-authenticated remote code execution in WordPress core

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC★ 1

PoC for CVE-2026-46420, command injection in shivammathur/setup-php via repository-controlled PHP version resolution.

CVE-2026-46420MEDIUM18 jul 2026

setup-php: Command Injection in Repository-Derived PHP Version Resolution

33RIESGO

GitHub PoC★ 15

Educational PoC + lab for CVE-2026-63030 + CVE-2026-60137: pre-auth SQLi in WordPress core via REST batch-route confusion

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

mrx-arafat/CVE-2026-63030-POC

CVE-2026-63030CRITICALbajo ataque18 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC

The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

CVE-2026-56291CRITICALbajo ataque18 jul 2026

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1

98RIESGO

GitHub PoC

Academic proof-of-concept demonstrating CVE-2026-46442 for authorized security research.

CVE-2026-46442CRITICAL17 jul 2026

Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

63RIESGO

GitHub PoC

Pentest completo sobre Metasploitable: recon con nmap, explotación con Metasploit (CVE-2007-2447), extracción y cracking de credenciales, persistencia SSH

CVE-2007-2447—17 jul 2026

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RIESGO

GitHub PoC★ 7

HIKRAVEN - Advanced Hikvision Security Assessment Platform for professional penetration testing. Detects 12+ CVEs including CVE-2021-36260 (CRITICAL), tests default credentials, performs network discovery, and generates professional security reports. For authorized security testing only! 🛡️🔒

CVE-2021-36260CRITICALbajo ataque17 jul 2026

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RIESGO

GitHub PoC

Reproducer for CVE-2026-47323: Apache Camel CXF/Knative HeaderFilterStrategy missing inbound filtering, enabling Camel control-header injection (RCE via camel-exec) through CXF-RS/CXF-SOAP/Knative endpoints (fixed in 4.14.6/4.18.2/4.19.0)

CVE-2026-47323CRITICAL17 jul 2026

Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

48RIESGO

GitHub PoC

Reproducer for CVE-2026-48203: Apache Camel camel-solr SolrParam./SolrField. header injection enabling Solr document-field injection and SSRF via the shards parameter (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-48203CRITICAL17 jul 2026

Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

48RIESGO

GitHub PoC★ 865

KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499

CVE-2026-43499HIGH17 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 66

CVE-2026-63030, CVE-2026-60137, wp2shell scanner

CVE-2026-63030CRITICALbajo ataque17 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.