Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.899exploits catalogados
40.392CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.190 exploits
Referência
CVE-2026-105190
CVE-2026-105190MEDIUM
Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled
33RIESGO
abrir ↗
Referência
CVE-2026-85701
CVE-2026-85701MEDIUM
ramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authentication
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component com_gmaps 1.00 - 'mapId' SQL Injection
CVE-2007-4128—webappsphp
SQL injection vulnerability in index.php in the Firestorm Technologies GMaps (com_gmaps) 1.00 component for Joomla! allo
23RIESGO
abrir ↗
Referência
CVE-2026-93509
CVE-2026-93509MEDIUM
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount
33RIESGO
abrir ↗
Referência✓ VexDay Proof
AuraCMS Forum Module - SQL Injection
CVE-2007-4171—webappsphp
SQL injection vulnerability in komentar.php in the Forum Module for auraCMS (Modul Forum Sederhana) allows remote attack
23RIESGO
abrir ↗
Referência
CVE-2026-6958
CVE-2026-6958HIGH
Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exe
41RIESGO
abrir ↗
Referência
CVE-2026-6958
CVE-2026-6958HIGH
Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exe
41RIESGO
abrir ↗
Referência
CVE-2026-85522
CVE-2026-85522MEDIUM
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
33RIESGO
abrir ↗
Referência
CVE-2026-85514
CVE-2026-85514MEDIUM
StackStorm st2 API Key auth.py privileges management
33RIESGO
abrir ↗
Referência
CVE-2019-0232
CVE-2019-0232—
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RIESGO
abrir ↗
Referência
CVE-2026-107271
CVE-2026-107271MEDIUM
Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
33RIESGO
abrir ↗
Referência
CVE-2018-18797
CVE-2018-18797—
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RIESGO
abrir ↗
Referência
CVE-2026-95210
CVE-2026-95210MEDIUM
Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid exten
13RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component com_Marketplace 1.1.1 - SQL Injection
CVE-2008-0689—webappsphp
SQL injection vulnerability in index.php in the Marketplace (com_marketplace) 1.1.1 and 1.1.1-pl1 component for Joomla!
23RIESGO
abrir ↗
Referência
CVE-2020-8425
CVE-2020-8425—
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.
23RIESGO
abrir ↗
Referência
CVE-2022-47986
CVE-2022-47986CRITICALbajo ataqueransomware
IBM Aspera Faspex code execution
100RIESGO
abrir ↗
Referência
CVE-2022-48177
CVE-2022-48177MEDIUM
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability v
33RIESGO
abrir ↗
Referência
CVE-2026-105193
CVE-2026-105193MEDIUM
Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash
33RIESGO
abrir ↗
Referência
CVE-2026-107270
CVE-2026-107270HIGH
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
41RIESGO
abrir ↗
Referência
CVE-2026-107181
CVE-2026-107181HIGH
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RIESGO
abrir ↗
Referência
CVE-2017-9769
CVE-2017-9769—
A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpe
60RIESGO
abrir ↗
Referência
CVE-2020-11798
CVE-2020-11798—
A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before
50RIESGO
abrir ↗
Referência
CVE-2026-105643
CVE-2026-105643HIGH
Ghost: Stored XSS via Embed Card Previews
41RIESGO
abrir ↗
Referência
CVE-2026-105387
CVE-2026-105387MEDIUM
girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection
33RIESGO
abrir ↗
Referência
CVE-2020-14008
CVE-2020-14008—
Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in
35RIESGO
abrir ↗
Referência✓ VexDay Proof
neuron news 1.0 - 'index.php?q' Local File Inclusion
CVE-2007-5050—webappsphp
Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2023-27010
CVE-2023-27010HIGH
Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability all
41RIESGO
abrir ↗
Referência
CVE-2026-105389
CVE-2026-105389MEDIUM
feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-105388
CVE-2026-105388MEDIUM
feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
iziContents rc6 - Local/Remote File Inclusion
CVE-2007-5054—webappsphp
Multiple PHP remote file inclusion vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute ar
35RIESGO
abrir ↗
← anteriorpágina 304 / 873siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.