Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.062exploits catalogados

31.617CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.467Referência 19.791GitHub PoC 13.086VulnCheck XDB 8069Nuclei 4187Metasploit 3462✓ solo verificadosrecientes populares riesgo

71.062 exploits

GitHub PoC

POC for CVE-2025-48384

CVE-2025-48384HIGHbajo ataque21 jun 2026

Git allows arbitrary code execution through broken config quoting

71RIESGO

abrir ↗

GitHub PoC

POC for CVE-2026-21858

CVE-2026-21858CRITICAL21 jun 2026

n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

85RIESGO

abrir ↗

GitHub PoC

Technical analysis of CVE-2025-68613, a critical Expression Injection vulnerability in n8n that allows authenticated attackers to achieve Remote Code Execution (RCE)

CVE-2025-68613CRITICALbajo ataque21 jun 2026

n8n Vulnerable to Remote Code Execution via Expression Injection

100RIESGO

abrir ↗

GitHub PoC

POC for CVE-2025-32463

CVE-2025-32463CRITICALbajo ataque21 jun 2026

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RIESGO

abrir ↗

GitHub PoC

Full compromise of TryHackMe's Ice machine — Icecast 2.0.1 RCE (CVE-2004-1561) via buffer overflow, followed by Windows privilege escalation through UAC bypass / COM hijacking. Includes detailed methodology and remediation.

CVE-2004-1561—21 jun 2026

Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with

60RIESGO

abrir ↗

GitHub PoC

POC for CVE-2025-24054

CVE-2025-24054MEDIUMbajo ataque21 jun 2026

NTLM Hash Disclosure Spoofing Vulnerability

75RIESGO

abrir ↗

GitHub PoC

Luisbuilds-data/cve-2024-1086-writeup

CVE-2024-1086HIGHbajo ataqueransomware21 jun 2026

Use-after-free in Linux kernel's netfilter: nf_tables component

76RIESGO

abrir ↗

GitHub PoC

Technical analysis of Apache Tomcat CVE-2024-50379, covering root cause, exploitation conditions, detection strategies, and mitigation techniques.

CVE-2024-50379CRITICAL20 jun 2026

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

60RIESGO

abrir ↗

GitHub PoC

Time-Based Blind SQL Injection tool for MySQL - CVE-2019-9053

CVE-2019-9053—20 jun 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RIESGO

abrir ↗

GitHub PoC★ 3

🔥 CVE-2026-41091 SolarFlare | Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM via Cloud Files API + NTFS junction trickery. Forces Defender to write malicious payloads to System32 with SYSTEM rights. ⚠️ Actively exploited in wild. CVSS 7.8. Patch: Defender Engine 1.1.26040.8. 🛡️ Educational PoC only.

CVE-2026-41091HIGHbajo ataque20 jun 2026

Microsoft Defender Elevation of Privilege Vulnerability

71RIESGO

abrir ↗

GitHub PoC

ClearLotus-git/CVE-2026-4480-PoC

CVE-2026-4480CRITICAL20 jun 2026

Samba: samba: remote code execution in printing subsystem via unescaped job description

68RIESGO

abrir ↗

GitHub PoC

aelshimony-cloud/OpenWire-CVE-2023-46604-Investigation

CVE-2023-46604CRITICALbajo ataqueransomware20 jun 2026

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-37149 - SQL Injection vulnerability in the scost parameter of search_products.php in GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0.

CVE-2026-37149HIGH20 jun 2026

GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerabil

41RIESGO

abrir ↗

GitHub PoC★ 1

GadaLuBau1337/CVE-2026-44578

CVE-2026-44578HIGH20 jun 2026

Next.js: Server-side request forgery in applications using WebSocket upgrades

68RIESGO

abrir ↗

GitHub PoC★ 2

Missing Authorization to Unauthenticated File Modification

CVE-2026-11912HIGH20 jun 2026

Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action

41RIESGO

abrir ↗

GitHub PoC

CVE-2026-48611- authentication bypass in phpBB

CVE-2026-48611CRITICAL19 jun 2026

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or

63RIESGO

abrir ↗

VulnCheck XDB

local

CVE-2021-3560HIGHbajo ataque19 jun 2026

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2026-10520CRITICAL19 jun 2026

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote

85RIESGO

abrir ↗

GitHub PoC

Saku0512/CVE-2026-54761-poc

CVE-2026-54761MEDIUM19 jun 2026

Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services

33RIESGO

abrir ↗

VulnCheck XDB

info-leak

CVE-2026-7515CRITICAL19 jun 2026

BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style

48RIESGO

abrir ↗

GitHub PoC★ 2

CVE-2026-10520 - CVE-2026-10523 - Ivanti Sentry

CVE-2026-10523CRITICAL19 jun 2026

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allow

60RIESGO

abrir ↗

GitHub PoC

PoC for CVE-2022-0543 – Redis Remote Code Execution (RCE)

CVE-2022-0543CRITICALbajo ataque19 jun 2026

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific

100RIESGO

abrir ↗

GitHub PoC★ 4

Scanner PoC for CVE-2026-42530 -- nginx 1.31.0-1.31.1 HTTP/3 QPACK encoder stream Use-After-Free (CVSS 9.2)

CVE-2026-42530CRITICAL19 jun 2026

NGINX Open-Source ngx_http_v3_module vulnerability

48RIESGO

abrir ↗

GitHub PoC★ 1

Unauthenticated Privilege Escalation via Account Takeover

CVE-2026-11551CRITICAL19 jun 2026

Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover

48RIESGO

abrir ↗

GitHub PoC

AlexMihailEngineer/CVE-2026-11784-Optimole-CSRF

CVE-2026-11784MEDIUM19 jun 2026

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action

33RIESGO

abrir ↗

GitHub PoC

CVE-2026-42055 - Draft

CVE-2026-42055CRITICAL19 jun 2026

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

48RIESGO

abrir ↗

GitHub PoC

xxconi/CVE-2026-4782

CVE-2026-4782MEDIUM19 jun 2026

Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter

33RIESGO

abrir ↗

GitHub PoC★ 2

POC for CVE-2026-25212

CVE-2026-25212CRITICAL19 jun 2026

An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileg

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-7515: BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion TO RCE EXPLOİT

CVE-2026-7515CRITICAL19 jun 2026

BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style

48RIESGO

abrir ↗

GitHub PoC

CVE-2026-42530 - Draft

CVE-2026-42530CRITICAL19 jun 2026

NGINX Open-Source ngx_http_v3_module vulnerability

48RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.