Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.752exploits catalogados

39.319CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.394Exploit-DB 24.485GitHub PoC 16.221VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.225 exploits

GitHub PoC★ 1

CVE-2024-25600 - Unauthenticated RCE exploit for WordPress Bricks Builder Theme. Advanced exploitation framework with interactive shell, reverse shells, file upload/download, async scanning, stealth mode, proxy support, and multi-threaded vulnerability scanning. For authorized security testing only.

CVE-2024-25600CRITICAL16 jul 2026

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RIESGO

GitHub PoC★ 2

syxlox/CVE-2026-50369

CVE-2026-50369HIGH16 jul 2026

Windows Remote Desktop Services Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC★ 58

Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026.

CVE-2026-49176HIGH16 jul 2026

Windows WalletService Elevation of Privilege Vulnerability

41RIESGO

GitHub PoC★ 3

🔐 CVE-2026-57821 - Apache Fineract SQL Injection Toolkit 📚 Two Python scripts for authorized security testing: verifier.py (safe detection, no extraction) and exploit.py (deep analysis). Supports 11 DB types. Perfect for understanding SQL injection vulnerabilities. Only legal tests ⚠️ for educational & research purposes only.

CVE-2026-57821HIGH16 jul 2026

Apache Fineract: Office list: SQL Injection via Subquery in orderBy

41RIESGO

GitHub PoC

Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228).

CVE-2021-44228CRITICALbajo ataqueransomware16 jul 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RIESGO

GitHub PoC★ 1

Complete exploitation toolkit for CVE-2026-3180 - WordPress Contest Gallery SQL Injection vulnerability. Features automated data extraction, WAF bypass, reverse shell, SQLMap integration, Burp extension generation, and reporting for penetration testing and security research.

CVE-2026-3180HIGH16 jul 2026

Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection

41RIESGO

GitHub PoC★ 6

this is a modified POC of rz1027 for CVE-2026-20896

CVE-2026-20896CRITICAL16 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

63RIESGO

GitHub PoC

KVM KernelCare + Januscape (CVE-2026-53359) verification & mitigation scripts

CVE-2026-53359HIGH16 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RIESGO

GitHub PoC

CVE-2026-15409 - Dectect

CVE-2026-15409CRITICALbajo ataqueransomware15 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

93RIESGO

GitHub PoC

Panduan mitigasi Januscape (CVE-2026-53359) AlmaLinux 9.5 production-safe + scripts

CVE-2026-53359HIGH15 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RIESGO

GitHub PoC

seqra/cve-2026-58138

CVE-2026-58138CRITICAL15 jul 2026

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

68RIESGO

GitHub PoC

My portfolio showcasing vulnerability research (CVE-2026-11989, CVE-2026-11395) and automated threat orchestration engineering (Lucius Engine, TalonVigil).

CVE-2026-11989MEDIUM15 jul 2026

Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping

33RIESGO

GitHub PoC

WhatsWrongAndWhy/CVE-2015-1328

CVE-2015-1328—15 jul 2026

The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no

50RIESGO

GitHub PoC★ 2

Raimu0x19/CVE-2026-13001

CVE-2026-13001CRITICAL15 jul 2026

Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

63RIESGO

GitHub PoC

lamaper/CVE-2026-52199

CVE-2026-52199CRITICAL15 jul 2026

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/

48RIESGO

GitHub PoC★ 21

PoC for CVE-2026-3891 — Unauthenticated Arbitrary File Upload leading to Remote Code Execution in Pix for WooCommerce <= 1.5.0

CVE-2026-3891CRITICAL15 jul 2026

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

68RIESGO

GitHub PoC

A 16-year-old bug in the Linux kernel lets a rented VM break out and attack the host it runs on. Intel and AMD alike. Januscape is a use-after-free vulnerability in the KVM code that has been sitting there since 2010.

CVE-2026-53359HIGH15 jul 2026

KVM: x86: Fix shadow paging use-after-free due to unexpected role

41RIESGO

GitHub PoC

arpit-bansal15/cve-2026-48282-pentest-lab

CVE-2026-48282CRITICALbajo ataque15 jul 2026

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

100RIESGO

GitHub PoC★ 3

CVE-2026-15409

CVE-2026-15409CRITICALbajo ataqueransomware15 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

93RIESGO

GitHub PoC

Mass Exploiter for CVE-2026-49049

CVE-2026-49049HIGH15 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

56RIESGO

GitHub PoC

FzRsLLaSheR/CVE-2026-14960-CVE-2026-14961

CVE-2026-14960CRITICAL15 jul 2026

CVE-2026-14960

48RIESGO

GitHub PoC

Technical analysis and safety-conscious research harness for CVE-2019-6447 in ES File Explorer for Android

CVE-2019-6447—15 jul 2026

The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary fi

50RIESGO

GitHub PoC★ 12

CVE-2026-56164 EOP Exploit

CVE-2026-56164MEDIUMbajo ataque15 jul 2026

Microsoft SharePoint Server Elevation of Privilege Vulnerability

63RIESGO

GitHub PoC

Reproducer for CVE-2026-46588: Apache Camel camel-couchdb CouchDb* header injection (operation confusion) subverting a write-only endpoint into read + delete of arbitrary documents (fixed in 4.14.8/4.18.3/4.21.0)

CVE-2026-46588HIGH15 jul 2026

Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

41RIESGO

GitHub PoC

exploit for CVE-2022-42889

CVE-2022-42889—15 jul 2026

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

60RIESGO

GitHub PoC

Podlove Podcast Publisher Unauthenticated File Upload RCE via is_image() vs extract_file_extension() Mismatch | CVSS 9.8

CVE-2026-13001CRITICAL15 jul 2026

Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

63RIESGO

GitHub PoC

Kanak-CypherX/cve-2024-4577-lab

CVE-2024-4577CRITICALbajo ataqueransomware15 jul 2026

Argument Injection in PHP-CGI

100RIESGO

GitHub PoC

WhatsWrongAndWhy/CVE-2016-9793

CVE-2016-9793—15 jul 2026

The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbu

23RIESGO

GitHub PoC★ 10

CvE-2026-43499偏移量计算

CVE-2026-43499HIGH15 jul 2026

rtmutex: Use waiter::task instead of current in remove_waiter()

41RIESGO

GitHub PoC★ 28

This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the websocket for file r/w and arbitrary code execution via RPC calls.

CVE-2026-15409CRITICALbajo ataqueransomware15 jul 2026

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A

93RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.