Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.780exploits catalogados

39.319CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.249 exploits

GitHub PoC★ 2

Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated Stored Cross-Site Scripting Proof of Concept

CVE-2026-10104MEDIUM05 jul 2026

Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter

33RIESGO

abrir ↗

GitHub PoC

Pre-auth Local File Inclusion in WP User Manager <= 2.9.17 via path traversal in tab parameter (CVSS 7.5)

CVE-2026-9290HIGH05 jul 2026

WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter

56RIESGO

abrir ↗

GitHub PoC★ 1

Offline jQuery CVE-2020-11023 remediation kit for legacy Spring/JSP - Node.js built-ins only (no npm, no internet)

CVE-2020-11023MEDIUMbajo ataque05 jul 2026

Potential XSS vulnerability in jQuery

85RIESGO

abrir ↗

GitHub PoC

Research and hands-on PoC of Spectre Variant 2 (CVE-2017-5715), a hardware side-channel vulnerability exploiting CPU speculative execution and branch prediction. Includes lab setup, vulnerability identification, exploit walkthrough, cache-timing analysis, demo video, and mitigation strategies.

CVE-2017-5715MEDIUM05 jul 2026

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl

55RIESGO

abrir ↗

GitHub PoC

MESLIMOHAMEDM22005188/path-traversal-CVE-2026-14628

CVE-2026-14628MEDIUM05 jul 2026

NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal

33RIESGO

abrir ↗

GitHub PoC★ 4

Pre-auth path traversal to arbitrary file delete in Avada (Fusion) Builder <= 3.15.3 leading to RCE (CVSS 9.1)

CVE-2026-8713CRITICAL05 jul 2026

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value

63RIESGO

abrir ↗

GitHub PoC

Eliot-code/CVE-2026-22874-PoC

CVE-2026-22874CRITICAL05 jul 2026

Gitea webhook and migration allow-list filtering permits SSRF

48RIESGO

abrir ↗

GitHub PoC

 CVE-2026-49049 - Unauthenticated File Deletion, Arbitrary Write & XSS Injection for Helix3 Joomla Extension

CVE-2026-49049HIGH05 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

56RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2018-10933 - libssh Authentication Bypass

CVE-2018-10933CRITICAL05 jul 2026

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul

85RIESGO

abrir ↗

GitHub PoC

PoC of Langflow CVE-2026-33017

CVE-2026-33017CRITICALbajo ataque04 jul 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

98RIESGO

abrir ↗

GitHub PoC★ 1

caterscam/CVE-2026-5524-PoC

CVE-2026-5524CRITICAL04 jul 2026

Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter

63RIESGO

abrir ↗

GitHub PoC★ 1

Python & template nuclei

CVE-2026-48907CRITICALbajo ataque04 jul 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

98RIESGO

abrir ↗

GitHub PoC

Casdoor version 2.362.0

CVE-2026-9090CRITICAL04 jul 2026

CVE-2026-9090

48RIESGO

abrir ↗

GitHub PoC

Script de python para Webmin 1.996

CVE-2022-36446—04 jul 2026

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

60RIESGO

abrir ↗

GitHub PoC

Technical troubleshooting repository for fixing infinite rendering vulnerability loops and resource exhaustion threats under CVE-2026-23869 cleanly.

CVE-2026-23869HIGH04 jul 2026

A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-

41RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-54998 RCE Exploit

CVE-2026-54998HIGH04 jul 2026

Microsoft Exchange Online Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

GitHub PoC★ 5

Apache ActiveMQ Classic RCE research: CVE-2026-34197 / CVE-2026-42588 bypass chain + hardened-6.2.6 audit findings + Crowdfense comparison

CVE-2026-34197HIGHbajo ataque04 jul 2026

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

91RIESGO

abrir ↗

GitHub PoC

SLO-CYBER-SEC/CVE-2026-78850

CVE-2026-78850MEDIUM04 jul 2026

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / Sites

33RIESGO

abrir ↗

GitHub PoC

SLO-CYBER-SEC/CVE-2026-78851

CVE-2026-78851MEDIUM04 jul 2026

Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive informati

33RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-22874 writeup: incomplete SSRF allow-list in Gitea webhook/migration (IPv6 transition and cloud metadata). Fixed in Gitea 1.26.3.

CVE-2026-22874CRITICAL04 jul 2026

Gitea webhook and migration allow-list filtering permits SSRF

48RIESGO

abrir ↗

GitHub PoC

Unauthenticated RCE in Langflow <1.9.0 (CVE-2026-33017) Exploit

CVE-2026-33017CRITICALbajo ataque04 jul 2026

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

98RIESGO

abrir ↗

GitHub PoC

iicaicai/CVE-2026-5524-PoC

CVE-2026-5524CRITICAL04 jul 2026

Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter

63RIESGO

abrir ↗

GitHub PoC★ 1

💉 Blind SQL Injection → RCE exploit for Control Web Panel (CWP) ≤ 0.9.8.1224 — userRes POST → INTO DUMPFILE → cwpsvc shell

CVE-2026-57517CRITICAL04 jul 2026

Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

48RIESGO

abrir ↗

GitHub PoC★ 19

CVE-2026-46242

CVE-2026-46242HIGH04 jul 2026

eventpoll: fix ep_remove struct eventpoll / struct file UAF

41RIESGO

abrir ↗

GitHub PoC★ 2

PoC for CVE-2026-54415 — Azuriom CMS (<1.2.11) Broken Access Control → account takeover

CVE-2026-54415HIGH04 jul 2026

Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover

41RIESGO

abrir ↗

GitHub PoC

Static config scanner that flags nginx configs vulnerable to the complex_value two-pass capture-clobbering bug (regex map + regex capture → heap overflow / info leak).

CVE-2026-42533CRITICAL04 jul 2026

NGINX Map directive and Regex matching vulnerability

48RIESGO

abrir ↗

GitHub PoC

Exploit for MCPJam Inspector - Remote Code Execution (CVE-2026-23744)

CVE-2026-23744CRITICAL04 jul 2026

REC in MCPJam inspector due to HTTP Endpoint exposes

75RIESGO

abrir ↗

GitHub PoC★ 1

CVE-2026-34038: Authenticated Remote Command Injection in Coolify

CVE-2026-34038CRITICAL04 jul 2026

Coolify authenticated remote command injection leading to RCE and secret exfiltration

48RIESGO

abrir ↗

GitHub PoC★ 4

Read-only vulnerability scanner for CVE-2026-49049 — Helix3 Joomla plugin unauthenticated AJAX handler

CVE-2026-49049HIGH04 jul 2026

Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler

56RIESGO

abrir ↗

GitHub PoC

CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT signature bypass (embargoed until Apache advisory)

CVE-2026-59243CRITICAL04 jul 2026

Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

48RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.