Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

79.305exploits catalogados

36.465CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.466Referência 23.051GitHub PoC 15.051VulnCheck XDB 8883Nuclei 4361Metasploit 3493✓ solo verificadosrecientes populares riesgo

77.866 exploits

GitHub PoC★ 4

A Metasploit auxiliary module that escalates from any low-privileged domain user to full domain compromise by abusing the AD CS enrollment "chase" fallback. The CA can be coerced into authenticating back to attacker-controlled infrastructure and then issuing a certificate that impersonates a Domain Controller.

CVE-2026-54121HIGH31 jul 2026

Active Directory Certificate Services Elevation of Privilege Vulnerability

41RIESGO

VulnCheck XDB

local

CVE-2021-3156HIGHbajo ataque31 jul 2026

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

VulnCheck XDB

info-leak

CVE-2024-23897CRITICALbajo ataqueransomware31 jul 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RIESGO

GitHub PoC

Aimy Captcha-Less Form Guard Joomla Component PHP Object Injection RCE. clfgd XOR keystream recovery + unserialize(). CVSS 10.0 | CWE-502 | aimy_captcha-less_form_guard < 20.1

CVE-2026-65883CRITICAL30 jul 2026

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

48RIESGO

GitHub PoC

CVE-2026-63030 Exploit | by gr1tx

CVE-2026-63030CRITICALbajo ataque30 jul 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

100RIESGO

GitHub PoC★ 1

JetBrains TeamCity On-Premises CVE-2026-63077 Emergency Hardening & Patch Runbook Package

CVE-2026-63077CRITICALbajo ataque30 jul 2026

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin

98RIESGO

GitHub PoC

HeltonPojo/CVE-2025-32432

CVE-2025-32432CRITICALbajo ataque30 jul 2026

Craft CMS Allows Remote Code Execution

100RIESGO

GitHub PoC★ 2

Security research tool for FortiWeb CVE-2025-64446 vulnerability. Automated exploitation framework with advanced logging, real-time metrics, proxy debugging, and professional reporting. Includes retry logic, multi-threading, and configurable settings. For authorized security testing only. CVSS 9.8 Critical.

CVE-2025-64446CRITICALbajo ataque30 jul 2026

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

VulnCheck XDB

initial-access

CVE-2025-64446CRITICALbajo ataque30 jul 2026

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb

100RIESGO

GitHub PoC★ 1

CVE-2026-10702

CVE-2026-10702MEDIUM30 jul 2026

JIT miscompilation in the JavaScript Engine: JIT component

33RIESGO

GitHub PoC★ 2

Nowafen/CVE-2026-16723

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

GitHub PoC★ 1

Fastjson RCE

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

GitHub PoC

DJ-Classifieds Joomla Component Unauthenticated File Upload RCE. 3-string filter bypass via PHP short tags. CVSS 10.0 | CWE-434 | com_djclassifieds < 3.11.2

CVE-2026-61424CRITICAL30 jul 2026

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

48RIESGO

GitHub PoC

Security Advisory: Stored Cross-Site Scripting Via Agent Messages Leading To Session Token Theft (openclaw-dashboard)

CVE-2026-66421HIGH30 jul 2026

OpenClaw Dashboard Stored XSS via lastMessage Session Field

41RIESGO

GitHub PoC

Hands-on exploit lab for CVE-2024-28000 — unauthenticated privilege escalation in LiteSpeed Cache (WordPress plugin, <=6.3.0.1). Spins up a vulnerable environment with Docker and includes a Go-based brute-forcer that cracks the weak mt_rand hash to create an administrator account.

CVE-2024-28000CRITICAL30 jul 2026

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

75RIESGO

GitHub PoC

KunalKhandelwal-dev/cve-2021-41773-lab

CVE-2021-41773HIGHbajo ataqueransomware30 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

VulnCheck XDB

initial-access

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

VulnCheck XDB

initial-access

CVE-2024-28000CRITICAL30 jul 2026

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

75RIESGO

GitHub PoC★ 2

A critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83.

CVE-2026-16723CRITICAL30 jul 2026

Remote Code Execution in fastjson 1.2.68–1.2.83

48RIESGO

GitHub PoC

shootcannon/CVE-2026-61511

CVE-2026-61511CRITICAL30 jul 2026

vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

48RIESGO

GitHub PoC

Demonstrate the unauthenticated remote code execution vulnerability in the RSFiles! Joomla component through an arbitrary file upload.

CVE-2026-57827CRITICAL30 jul 2026

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

63RIESGO

GitHub PoC

CVE-2026-59726 - Draft or Todo

CVE-2026-59726CRITICAL30 jul 2026

Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

48RIESGO

GitHub PoC

nawalacheker1/CVE-2026-46331

CVE-2026-46331HIGH30 jul 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RIESGO

GitHub PoC★ 25

rails/rails-forensics-CVE-2026-66066

CVE-2026-66066CRITICAL30 jul 2026

Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

48RIESGO

GitHub PoC

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover (openclaw-dashboard)

CVE-2026-66418CRITICAL30 jul 2026

OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

48RIESGO

GitHub PoC

webshellseo8/CVE-2026-50522-Proof-of-Concept

CVE-2026-50522CRITICALbajo ataque29 jul 2026

Microsoft SharePoint Remote Code Execution Vulnerability

100RIESGO

GitHub PoC★ 1

CVE-2026-45746, CVE-2026-45750, CVE-2026-53547 — three critical vulnerabilities in Termix: cross-tenant session hijacking, OS command injection, and account takeover

CVE-2026-45746CRITICAL29 jul 2026

Termix Vulnerable to Arbitrary Command Execution via Session Hijacking

48RIESGO

GitHub PoC

manfredgabriel/cve-2021-41773-lab

CVE-2021-41773HIGHbajo ataqueransomware29 jul 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

GitHub PoC★ 15

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE. Split-controller upload bypass. CVSS 9.8 | CWE-434 | com_rsfiles < 1.17.12

CVE-2026-57827CRITICAL29 jul 2026

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

63RIESGO

GitHub PoC★ 1

Gitea Docker Image Authentication Bypass

CVE-2026-20896CRITICAL29 jul 2026

Gitea Docker image trusts spoofable reverse-proxy headers by default

75RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.