Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.899exploits catalogados
40.392CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.190 exploits
Referência
CVE-2019-25757
CVE-2019-25757HIGH
Joomla vWishlist 1.0.1 SQL Injection via vproductid Parameter
41RIESGO
abrir ↗
Referência
WordPress Core 5.8.2 - 'WP_Query' SQL Injection
CVE-2022-21661HIGHwebappsphp
SQL injection in WordPress
78RIESGO
abrir ↗
Referência
CVE-2026-12823
CVE-2026-12823MEDIUM
Browserbase Skills Autobrowse Trace Artifact default permission
33RIESGO
abrir ↗
Referência
CVE-2014-8654
CVE-2014-8654—
Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wirele
23RIESGO
abrir ↗
Referência
CVE-2017-17849
CVE-2017-17849—
A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to exec
28RIESGO
abrir ↗
Referência
CVE-2017-17849
CVE-2017-17849—
A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to exec
28RIESGO
abrir ↗
Referência
CVE-2026-110983
CVE-2026-110983MEDIUM
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
33RIESGO
abrir ↗
Referência
CVE-2026-110505
CVE-2026-110505MEDIUM
Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
33RIESGO
abrir ↗
Referência
CVE-2018-14064
CVE-2018-14064—
The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../..
50RIESGO
abrir ↗
Referência
CVE-2026-113486
CVE-2026-113486MEDIUM
Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
33RIESGO
abrir ↗
Referência
CVE-2015-0554
CVE-2015-0554—
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly rest
50RIESGO
abrir ↗
Referência
CVE-2017-5586
CVE-2017-5586—
OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a craf
28RIESGO
abrir ↗
Referência
CVE-2023-22855
CVE-2023-22855CRITICAL
Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 808
53RIESGO
abrir ↗
Referência
CVE-2026-113485
CVE-2026-113485MEDIUM
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
33RIESGO
abrir ↗
Referência
CVE-2026-111967
CVE-2026-111967MEDIUM
MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute
33RIESGO
abrir ↗
Referência
CVE-2026-111032
CVE-2026-111032LOW
Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax
28RIESGO
abrir ↗
Referência✓ VexDay Proof
MyPHP CMS 0.3 - 'domain' Remote File Inclusion
CVE-2006-3478—webappsphp
PHP remote file inclusion vulnerability in styles/default/global_header.php in MyPHP CMS 0.3 and earlier, when register_
23RIESGO
abrir ↗
Referência
CVE-2017-5638
CVE-2017-5638CRITICALbajo ataqueransomware
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RIESGO
abrir ↗
Referência
CVE-2015-1479
CVE-2015-1479—
SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 buil
23RIESGO
abrir ↗
Referência
CVE-2017-0148
CVE-2017-0148HIGHbajo ataqueransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗
Referência
CVE-2026-83524
CVE-2026-83524CRITICAL
RedPort Optimizer wXa-223 System Clock datetime.php exec command injection
48RIESGO
abrir ↗
Referência
CVE-2017-16542
CVE-2017-16542—
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name param
23RIESGO
abrir ↗
Referência
CVE-2017-7237
CVE-2017-7237—
The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spicewor
23RIESGO
abrir ↗
Referência
CVE-2020-1147
CVE-2020-1147HIGHbajo ataque
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the softwar
100RIESGO
abrir ↗
Referência
CVE-2026-107097
CVE-2026-107097MEDIUM
Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe
33RIESGO
abrir ↗
Referência
CVE-2026-106647
CVE-2026-106647LOW
Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Sabdrimer PRO 2.2.4 - 'pluginpath' Remote File Inclusion
CVE-2006-3520—webappsphp
PHP remote file inclusion vulnerability in skins/advanced/advanced1.php in Sabdrimer Pro 2.2.4, when register_globals is
23RIESGO
abrir ↗
Referência
CVE-2020-11651
CVE-2020-11651CRITICALbajo ataque
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Active Auction Pro 7.1 - 'default.asp?catid' SQL Injection
CVE-2007-1712—webappsasp
SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Auction Pro 7.1 allows remote attackers to execu
23RIESGO
abrir ↗
Referência
CVE-2026-82816
CVE-2026-82816MEDIUM
dibo-software diboot AI Session Endpoint ai-session authorization
33RIESGO
abrir ↗
← anteriorpágina 318 / 873siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.