Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.508exploits catalogados
40.258CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.095Exploit-DB 24.488GitHub PoC 17.831VulnCheck XDB 10.015Nuclei 4547Metasploit 3532✓ solo verificadosrecientespopularesriesgo
26.095 exploits
Referência
CVE-2014-9415
CVE-2014-9415—
Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted QE
23RIESGO
abrir ↗
Referência
CVE-2026-82925
CVE-2026-82925HIGH
Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Ultimate HelpDesk - Cross-Site Scripting / Local File Disclosure
CVE-2006-6380—webappsasp
Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary w
23RIESGO
abrir ↗
Referência
CVE-2010-4830
CVE-2010-4830—
SQL injection vulnerability in Resumes/TD_RESUME_Indlist.asp in Techno Dreams (T-Dreams) Job Career Package 3.0 allows r
23RIESGO
abrir ↗
Referência
CVE-2014-9416
CVE-2014-9416—
Multiple untrusted search path vulnerabilities in Huawei eSpace Desktop before V200R003C00 allow local users to execute
23RIESGO
abrir ↗
Referência
CVE-2016-1287
CVE-2016-1287—
Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0
45RIESGO
abrir ↗
Referência
CVE-2026-108879
CVE-2026-108879MEDIUM
JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-108878
CVE-2026-108878MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById
33RIESGO
abrir ↗
Referência
CVE-2021-39144
CVE-2021-39144HIGHbajo ataque
XStream is vulnerable to a Remote Command Execution attack
100RIESGO
abrir ↗
Referência
CVE-2016-5847
CVE-2016-5847—
SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard l
23RIESGO
abrir ↗
Referência
CVE-2017-9248
CVE-2017-9248CRITICALbajo ataque
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
100RIESGO
abrir ↗
Referência
CVE-2026-108861
CVE-2026-108861MEDIUM
Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool
33RIESGO
abrir ↗
Referência
CVE-2026-89304
CVE-2026-89304MEDIUM
Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter
33RIESGO
abrir ↗
Referência✓ VexDay Proof
BlazeVideo HDTV Player 2.1 - '.PLF' Local Buffer Overflow
CVE-2006-6396—localwindows
Stack-based buffer overflow in BlazeVideo HDTV Player 2.1, and possibly earlier, allows remote attackers to execute arbi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
J-OWAMP Web Interface 2.1b - 'link' Remote File Inclusion
CVE-2006-6453—webappsphp
PHP remote file inclusion vulnerability in JOWAMP_ShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Fantastic News 2.1.4 - 'news.php' SQL Injection
CVE-2006-6542—webappsphp
SQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2026-12809
CVE-2026-12809MEDIUM
Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection
33RIESGO
abrir ↗
Referência
CVE-2026-12770
CVE-2026-12770MEDIUM
BerriAI litellm Admin Key key_management_endpoints.py improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-87928
CVE-2026-87928MEDIUM
MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page
33RIESGO
abrir ↗
Referência
CVE-2026-9710
CVE-2026-9710HIGH
Themeco Cornerstone < 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash Disclosure
41RIESGO
abrir ↗
Referência
CVE-2026-83537
CVE-2026-83537MEDIUM
WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment
33RIESGO
abrir ↗
Referência
CVE-2026-84258
CVE-2026-84258HIGH
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications
41RIESGO
abrir ↗
Referência
CVE-2016-6434
CVE-2016-6434—
Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive
23RIESGO
abrir ↗
Referência
CVE-2015-2366
CVE-2015-2366—
win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Wi
23RIESGO
abrir ↗
Referência
CVE-2016-6435
CVE-2016-6435—
The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via
50RIESGO
abrir ↗
Referência
CVE-2026-13488
CVE-2026-13488MEDIUM
SourceCodester Class and Exam Timetabling System preview7.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2016-6483
CVE-2016-6483—
The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Le
28RIESGO
abrir ↗
Referência
CVE-2023-28285
CVE-2023-28285HIGH
Microsoft Office Remote Code Execution Vulnerability
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Sambar FTP Server 6.4 - 'SIZE' Remote Denial of Service
CVE-2006-6624—doswindows
The FTP Server in Sambar Server 6.4 allows remote authenticated users to cause a denial of service (application crash) v
23RIESGO
abrir ↗
Referência
CVE-2026-12786
CVE-2026-12786HIGH
Ezbsystems UltraISO Premium Edition Kernel Driver bootpt64.sys access control
41RIESGO
abrir ↗
← anteriorpágina 260 / 870siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.