Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.780exploits catalogados

39.319CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.249 exploits

GitHub PoC

The SSRF filter checked hostname text, but the actual destination was decided later by DNS. That gap let attacker-controlled Webhook URLs reach loopback, metadata, and private network targets.

CVE-2026-34207HIGH26 jun 2026

TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation

41RIESGO

GitHub PoC

scanner for CVE-2020-0796

CVE-2020-0796CRITICALbajo ataqueransomware26 jun 2026

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RIESGO

GitHub PoC★ 4

aexdyhaxor/CVE-2026-43503-DirtyClone

CVE-2026-43503HIGH26 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

56RIESGO

GitHub PoC

Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin.

CVE-2026-34212MEDIUM26 jun 2026

Docmost page content has stored XSS via unsanitized attachment URLs

33RIESGO

GitHub PoC

Cacti <= 1.2.30

CVE-2026-39938CRITICAL26 jun 2026

Cacti: Unauthenticated RCE on Graph Image

48RIESGO

GitHub PoC

12hrformat/CVE-2026-35273-POC

CVE-2026-35273CRITICALbajo ataqueransomware26 jun 2026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

100RIESGO

GitHub PoC★ 1

Ghost CMS Content API Blind SQL Injection

CVE-2026-26980CRITICAL26 jun 2026

Ghost has a SQL Injection in its Content API

63RIESGO

GitHub PoC★ 3

CVE-2026-20251 — Splunk Secure Gateway jsonpickle deserialization RCE (CVSS 8.8) | ReactiveZero Security Research

CVE-2026-20251HIGH26 jun 2026

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

53RIESGO

GitHub PoC

Full Metasploit exploitation walkthrough against Metasploitable2 — vsftpd backdoor, Samba CVE-2007-2447, UnrealIRCd backdoor, Netcat exfiltration, and credential cracking prep.

CVE-2007-2447—26 jun 2026

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RIESGO

GitHub PoC★ 11

CVE-2026-26980 - Ghost CMS Content API SQL Injection

CVE-2026-26980CRITICAL26 jun 2026

Ghost has a SQL Injection in its Content API

63RIESGO

GitHub PoC

A local package installation helper trusted caller-supplied package names too much. In yeoman-environment, missing generators could be installed without user confirmation, turning attacker-controlled project metadata into a package-install and code-execution path.

CVE-2026-42089HIGH26 jun 2026

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

41RIESGO

GitHub PoC

Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering.

CVE-2026-45806HIGH26 jun 2026

Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url

41RIESGO

GitHub PoC★ 1

SCAN END POC THE CVE-2024-4367

CVE-2024-4367MEDIUM25 jun 2026

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RIESGO

GitHub PoC

Lab — Privilege Escalation via Dirty Cow CVE-2016-5195 | 4Geeks Academy

CVE-2016-5195HIGHbajo ataque25 jun 2026

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RIESGO

GitHub PoC

CVE-2026-55584 — phpSysInfo IP Allowlist Bypass

CVE-2026-55584HIGH25 jun 2026

phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

41RIESGO

GitHub PoC

Unauthenticated time-based blind SQL injection exploit for CMS Made Simple ≤ 2.2.9 (CVE-2019-9053), ported to Python 3.

CVE-2019-9053—25 jun 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RIESGO

GitHub PoC

POC of CVE-2026-53075

CVE-2026-53075HIGH25 jun 2026

ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

41RIESGO

GitHub PoC★ 1

CVE-2026-7574

CVE-2026-7574HIGH25 jun 2026

Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use

41RIESGO

GitHub PoC★ 1

VulnHub DC-1 boot-to-root — exploiting CVE-2018-7600 (Drupalgeddon2) for RCE, extracting DB credentials from settings.php, forging admin password hash, and escalating to root via SUID find.

CVE-2018-7600CRITICALbajo ataqueransomware25 jun 2026

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RIESGO

GitHub PoC★ 34

CVE-2026-43503

CVE-2026-43503HIGH25 jun 2026

net: skbuff: propagate shared-frag marker through frag-transfer helpers

56RIESGO

GitHub PoC

Squamity/CVE-2026-8181-PoC

CVE-2026-8181CRITICAL25 jun 2026

Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover

63RIESGO

GitHub PoC★ 1

W5M1n9/Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

CVE-2026-20230HIGHbajo ataque25 jun 2026

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

93RIESGO

GitHub PoC

7whyex/CVE-2026-45321-Tanstack

CVE-2026-45321CRITICALbajo ataqueransomware25 jun 2026

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

78RIESGO

GitHub PoC

ROOT TOOL

CVE-2022-37706HIGH24 jun 2026

enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and th

56RIESGO

GitHub PoC★ 3

Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter | Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover

CVE-2026-12416CRITICAL24 jun 2026

Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter

48RIESGO

GitHub PoC★ 1

Proof of Concept of CVE-2026-38526 in Krayin CRM <= v2.2.x. Arbitrary File Upload leading to Remote Code Execution

CVE-2026-38526CRITICAL24 jun 2026

An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x a

48RIESGO

GitHub PoC

CVE-2025-57819 FreePBX SQLi RCE PoC

CVE-2025-57819CRITICALbajo ataque24 jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RIESGO

GitHub PoC

Lỗ hổng FORTIWEB_CVE-2025-64446 & CVE-2025-58034

CVE-2025-64446CRITICALbajo ataque24 jun 2026

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

GitHub PoC

Khai thác lỗ hổng bảo mật CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware24 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

GitHub PoC★ 1

CVE-2026-49777, CVE-2026-10735

CVE-2026-49777CRITICAL24 jun 2026

WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability

63RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.