Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.853exploits catalogados

39.383CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

16.269 exploits

GitHub PoC

POC for CVE-2025-55182

CVE-2025-55182CRITICALbajo ataqueransomware21 jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RIESGO

abrir ↗

GitHub PoC

alexlanum/CVE-2026-32202

CVE-2026-32202MEDIUMbajo ataque21 jun 2026

Windows Shell Spoofing Vulnerability

63RIESGO

abrir ↗

GitHub PoC

Public disclosure for CVE-2026-43655 AppleM2ScalerCSCDriver use-after-free

CVE-2026-43655HIGH21 jun 2026

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macO

41RIESGO

abrir ↗

GitHub PoC

Hunt-Benito/ash-authentication-oauth2-oidc-account-takeover-cve-2026-49757-email-based-user-matching

CVE-2026-49757CRITICAL21 jun 2026

OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

48RIESGO

abrir ↗

GitHub PoC★ 1

Modern Joomla Auth-attack Toolkit J3 / J4 / J5 - CVE-2023-23752 · CVE-2023-23755 · CVE-2025-25227

CVE-2023-23752MEDIUMbajo ataque21 jun 2026

[20230201] - Core - Improper access check in webservice endpoints

100RIESGO

abrir ↗

GitHub PoC

webshellseo8/CVE-2026-48908-POC

CVE-2026-48908CRITICALbajo ataque21 jun 2026

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

100RIESGO

abrir ↗

GitHub PoC

ubaydev/CVE-2026-11551-PoC

CVE-2026-11551CRITICAL21 jun 2026

Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover

48RIESGO

abrir ↗

GitHub PoC

Traveller is an Easy Linux machine featuring a Joomla 4.2.7 travel booking website vulnerable to CVE-2023-23752, an unauthenticated REST API information disclosure that leaks database credentials, leading to admin panel access, remote code execution, and root via sudo misconfiguration.

CVE-2023-23752MEDIUMbajo ataque21 jun 2026

[20230201] - Core - Improper access check in webservice endpoints

100RIESGO

abrir ↗

GitHub PoC

asdrf5gh67j8ki/CVE-2026-32202

CVE-2026-32202MEDIUMbajo ataque21 jun 2026

Windows Shell Spoofing Vulnerability

63RIESGO

abrir ↗

GitHub PoC★ 24

CVE-2026-48909 PoC

CVE-2026-48909CRITICAL21 jun 2026

Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

63RIESGO

abrir ↗

GitHub PoC

POC for CVE-2025-24054

CVE-2025-24054MEDIUMbajo ataque21 jun 2026

NTLM Hash Disclosure Spoofing Vulnerability

75RIESGO

abrir ↗

GitHub PoC★ 1

GadaLuBau1337/CVE-2026-44578

CVE-2026-44578HIGH20 jun 2026

Next.js: Server-side request forgery in applications using WebSocket upgrades

56RIESGO

abrir ↗

GitHub PoC

aelshimony-cloud/OpenWire-CVE-2023-46604-Investigation

CVE-2023-46604CRITICALbajo ataqueransomware20 jun 2026

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2026-41091 RedSun | Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM 🔥 via Cloud Files API + NTFS junction trickery. Forces Defender to write malicious payloads to System32 with SYSTEM rights. ⚠️ Actively exploited in wild. CVSS 7.8. Patch: Defender Engine 1.1.26040.8. 🛡️ Educational PoC only.

CVE-2026-41091HIGHbajo ataque20 jun 2026

Microsoft Defender Elevation of Privilege Vulnerability

71RIESGO

abrir ↗

GitHub PoC★ 2

Missing Authorization to Unauthenticated File Modification

CVE-2026-11912HIGH20 jun 2026

Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action

41RIESGO

abrir ↗

GitHub PoC

Time-Based Blind SQL Injection tool for MySQL - CVE-2019-9053

CVE-2019-9053—20 jun 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RIESGO

abrir ↗

GitHub PoC

ClearLotus-git/CVE-2026-4480-PoC

CVE-2026-4480CRITICAL20 jun 2026

Samba: samba: remote code execution in printing subsystem via unescaped job description

68RIESGO

abrir ↗

GitHub PoC

HTTP/2 Bomb (CVE-2026-49975) non-destructive vulnerability detector for Nginx / Apache httpd. Zero-dependency Python.

CVE-2026-49975HIGH20 jun 2026

Apache HTTP Server: mod_http2 denial of service

41RIESGO

abrir ↗

GitHub PoC

Technical analysis of Apache Tomcat CVE-2024-50379, covering root cause, exploitation conditions, detection strategies, and mitigation techniques.

CVE-2024-50379CRITICAL20 jun 2026

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

60RIESGO

abrir ↗

GitHub PoC

CVE-2026-54337 - Unauthenticated File Write/Overwrite PoC for fireshare <= 1.16.3

CVE-2026-54337CRITICAL20 jun 2026

Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite

48RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-37149 - SQL Injection vulnerability in the scost parameter of search_products.php in GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0.

CVE-2026-37149HIGH20 jun 2026

GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerabil

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-42530 - Draft

CVE-2026-42530CRITICAL19 jun 2026

NGINX Open-Source ngx_http_v3_module vulnerability

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-7515: BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion TO RCE EXPLOİT

CVE-2026-7515CRITICAL19 jun 2026

BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style

48RIESGO

abrir ↗

GitHub PoC

Exploitability PoC for CVE-2026-43515 (Apache Tomcat constraint bypass).

CVE-2026-43515CRITICAL19 jun 2026

Apache Tomcat: Security constraints not correctly applied

48RIESGO

abrir ↗

GitHub PoC★ 2

ptd200110/CVE-2024-27198-SOC-Lab

CVE-2024-27198CRITICALbajo ataqueransomware19 jun 2026

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

100RIESGO

abrir ↗

GitHub PoC★ 4

Scanner PoC for CVE-2026-42530 -- nginx 1.31.0-1.31.1 HTTP/3 QPACK encoder stream Use-After-Free (CVSS 9.2)

CVE-2026-42530CRITICAL19 jun 2026

NGINX Open-Source ngx_http_v3_module vulnerability

48RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2022-0543 – Redis Remote Code Execution (RCE)

CVE-2022-0543CRITICALbajo ataque19 jun 2026

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific

100RIESGO

abrir ↗

GitHub PoC

AlexMihailEngineer/CVE-2026-11784-Optimole-CSRF

CVE-2026-11784MEDIUM19 jun 2026

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-42055 - Draft

CVE-2026-42055CRITICAL19 jun 2026

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

48RIESGO

abrir ↗

GitHub PoC

Повышение привилегий через race condition в polkit

CVE-2021-3560HIGHbajo ataque19 jun 2026

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.