Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.526exploits catalogados

39.162CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.281Exploit-DB 24.485GitHub PoC 16.144VulnCheck XDB 9617Nuclei 4476Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.144 exploits

GitHub PoC

CVE-2026-92084 — Beaver Builder Lite <= 2.11.0.5 unauthenticated arbitrary shortcode execution via Sidebar module widget output (CVSS 9.1): Docker validation lab with vulnerable/patched controls, safe-oracle Python PoC, nuclei version screen. Authorized security research only.

CVE-2026-92084CRITICAL04 oct 2026

Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

48RIESGO

GitHub PoC

TheJesterrrr/CVE-2026-19632

CVE-2026-19632CRITICAL04 oct 2026

TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

63RIESGO

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-90970CRITICAL03 oct 2026

Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

48RIESGO

GitHub PoC★ 8

CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is configured

CVE-2026-103956CRITICAL03 oct 2026

Missing authentication for critical function in Loom for AWS

48RIESGO

GitHub PoC

A python3 PoC for CVE-2026-105030 Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

CVE-2026-105030MEDIUM03 oct 2026

Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

33RIESGO

GitHub PoC

Guest-to-host KVM/x86 escape exploiting CVE-2026-64561, delivering a full PoC chain and analysis for security researchers.

CVE-2026-64561HIGH03 oct 2026

KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

41RIESGO

GitHub PoC

VulnHub DC-1 boot2root — unauthenticated RCE via Drupalgeddon2 (CVE-2018-7600) to SUID find privilege escalation, with severity-rated findings and remediation.

CVE-2018-7600CRITICALbajo ataqueransomware03 oct 2026

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RIESGO

GitHub PoC★ 2

CVE-2026-103648 | Path Traversal in image-downloader 4.3.0 | CVSS 9.1 Critical | CWE-22 | By EterNullSec

CVE-2026-103648CRITICAL03 oct 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

48RIESGO

GitHub PoC

Hands-on Learn SecByte CTF labs covering Beelzebub preparation, VM and network clues, Base64, CVE-2026-14461, admin panels, authentication, credential leaks, kernel security, reused keys, SQLMap, and web-to-root concepts.

CVE-2026-14461MEDIUM03 oct 2026

Out-of-bound read in mtr

33RIESGO

GitHub PoC★ 3

Proof-of-concept scanner and exploit helper for CVE-2026-14378: unauthenticated administrator session takeover in the WordPress plugin DevKit Pro (dplugins) through a flawed user-switch “revert” flow.

CVE-2026-19660CRITICAL03 oct 2026

Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

48RIESGO

GitHub PoC

Proof of concept for CVE-2026-92592: Craft CMS authenticated RCE

CVE-2026-92592HIGH03 oct 2026

Craft CMS before 4.18.6 Remote Code Execution via signed cookie

41RIESGO

GitHub PoC

CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept

CVE-2026-63030CRITICALbajo ataque03 oct 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RIESGO

GitHub PoC★ 1

Unauthenticated Privilege Escalation Mass Exploit Super Forms <= 6.3.316 CVE-2026-15989

CVE-2026-15989CRITICAL03 oct 2026

Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

48RIESGO

GitHub PoC

MotionEye OS Command Injection (CVE-2025-60787)

CVE-2025-60787HIGH03 oct 2026

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name

61RIESGO

GitHub PoC

An end-to-end infrastructure penetration testing lab showcasing automated scanning (Nikto), remote code execution (CVE-2012-1823), and manual kernel privilege escalation to Root (CVE-2008-0600).

CVE-2008-0600—03 oct 2026

The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo

23RIESGO

GitHub PoC

An end-to-end infrastructure penetration testing lab showcasing automated scanning (Nikto), remote code execution (CVE-2012-1823), and manual kernel privilege escalation to Root (CVE-2008-0600).

CVE-2012-1823CRITICALbajo ataque03 oct 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RIESGO

GitHub PoC

watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs

CVE-2026-88771CRITICALbajo ataque02 oct 2026

A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

78RIESGO

GitHub PoC

Unauthenticated RCE in Yamcs mission control via YAML injection in reconfigureInstance()

CVE-2026-55559CRITICAL02 oct 2026

Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)

48RIESGO

GitHub PoC★ 1

Meniben/redmi14c-pond-cve-2026-64560

CVE-2026-64560HIGH02 oct 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RIESGO

GitHub PoC★ 5

A python tool to detect PDF files exploiting CVE-2026-86950

CVE-2026-86950HIGHbajo ataque02 oct 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2

71RIESGO

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-103922CRITICAL02 oct 2026

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

48RIESGO

GitHub PoC

CVE-2026-102282: adm-zip LPE via SUID/SGID preservation during archive extraction (fixed in 0.6.1)

CVE-2026-102282HIGH02 oct 2026

adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

41RIESGO

GitHub PoC

Defensive analysis, patch breakdown, and passive detection scanner for CVE-2026-103752 (WordPress Authorizer Plugin <= 3.15.3).

CVE-2026-103752CRITICAL02 oct 2026

WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability

48RIESGO

GitHub PoC

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

CVE-2026-104286CRITICALbajo ataque02 oct 2026

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.

78RIESGO

GitHub PoC

Penetration testing portfolio: FTP vulnerability assessment & exploitation in isolated lab. Demonstrates network reconnaissance, CVE-2011-2523 validation, and post-exploitation verification. Complete methodology with evidence, findings, and remediation guidance.

CVE-2011-2523—02 oct 2026

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RIESGO

GitHub PoC★ 2

Sensitive info disclosure via info API in PictShare < 3.7.1 (CWE-522). PoC + advisory writeup.

CVE-2026-104051HIGH02 oct 2026

PictShare < 3.7.1 Sensitive Information Disclosure via info API

41RIESGO

GitHub PoC★ 4

Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup.

CVE-2026-100520HIGH02 oct 2026

Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

41RIESGO

GitHub PoC★ 2

Predictable delete_code via rand() in PictShare < 3.7.1 (CWE-338). PoC + advisory writeup.

CVE-2026-104356HIGH02 oct 2026

PictShare < 3.7.1 Predictable Delete Code via rand()

41RIESGO

GitHub PoC★ 2

Exploited a known RCE vulnerability (PHP-CGI Argument Injection, CVE-2012-1823) on Metasploitable2 using Metasploit Framework, gained a shell, and documented post-exploitation

CVE-2012-1823CRITICALbajo ataque02 oct 2026

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

100RIESGO

GitHub PoC

Out-of-bounds Write (CWE-787)

CVE-2026-86950HIGHbajo ataque02 oct 2026

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2

71RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.