Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.904exploits catalogados
40.394CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2026-14322
CVE-2026-14322MEDIUM
Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_method
33RIESGO
abrir ↗
Referência
CVE-2020-28328
CVE-2020-28328—
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain
50RIESGO
abrir ↗
Referência
CVE-2026-12965
CVE-2026-12965CRITICAL
Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking
48RIESGO
abrir ↗
Referência
CVE-2020-28328
CVE-2020-28328—
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain
50RIESGO
abrir ↗
Referência
CVE-2026-19978
CVE-2026-19978MEDIUM
jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection
33RIESGO
abrir ↗
Referência
CVE-2017-17649
CVE-2017-17649—
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-63769
CVE-2026-63769MEDIUM
Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method
33RIESGO
abrir ↗
Referência
CVE-2016-0492
CVE-2016-0492—
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
60RIESGO
abrir ↗
Referência
CVE-2016-0492
CVE-2016-0492—
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
60RIESGO
abrir ↗
Referência
CVE-2016-3473
CVE-2016-3473—
Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0,
28RIESGO
abrir ↗
Referência
CentOS Control Web Panel 0.9.8.836 - Authentication Bypass
CVE-2019-13605—webappslinux
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in
28RIESGO
abrir ↗
Referência
CVE-2019-13720
CVE-2019-13720HIGHbajo ataque
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap
83RIESGO
abrir ↗
Referência✓ VexDay Proof
Simplog 0.9.2 - 's' Remote Command Execution
CVE-2006-1778—webappsphp
Multiple SQL injection vulnerabilities in Jeremy Ashcraft Simplog 0.9.2 and earlier allow remote attackers to execute ar
23RIESGO
abrir ↗
Referência
CVE-2026-19968
CVE-2026-19968MEDIUM
Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h ReadFaces_3DGS_MDL7 heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-19967
CVE-2026-19967MEDIUM
Open Asset Import Library Assimp File Compression.cpp decompressBlock heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-19966
CVE-2026-19966MEDIUM
CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization
33RIESGO
abrir ↗
Referência
CVE-2026-8155
CVE-2026-8155MEDIUM
BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
33RIESGO
abrir ↗
Referência
CVE-2016-3987
CVE-2016-3987—
The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url para
28RIESGO
abrir ↗
Referência
CVE-2026-92920
CVE-2026-92920MEDIUM
admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled
33RIESGO
abrir ↗
Referência
CVE-2016-1525
CVE-2016-1525—
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RIESGO
abrir ↗
Referência
CVE-2019-1619
CVE-2019-1619CRITICAL
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RIESGO
abrir ↗
Referência
CVE-2019-16117
CVE-2019-16117—
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admi
23RIESGO
abrir ↗
Referência
CVE-2026-63764
CVE-2026-63764HIGH
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
41RIESGO
abrir ↗
Referência
CVE-2019-16119
CVE-2019-16119—
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/control
28RIESGO
abrir ↗
Referência
CVE-2019-1620
CVE-2019-1620CRITICAL
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RIESGO
abrir ↗
Referência
CVE-2014-10079
CVE-2014-10079—
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hid
23RIESGO
abrir ↗
Referência
CVE-2026-92919
CVE-2026-92919HIGH
admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename
41RIESGO
abrir ↗
Referência✓ VexDay Proof
ig shop 1.0 - Code Execution / SQL Injection
CVE-2007-0134—webappsphp
Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the
28RIESGO
abrir ↗
Referência
CVE-2026-93309
CVE-2026-93309MEDIUM
O-RAN-SC SMO OAM VES Collector allocation of resources
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Aratix 0.2.2b11 - '/inc/init.inc.php' Remote File Inclusion
CVE-2007-0135—webappsphp
PHP remote file inclusion vulnerability in inc/init.inc.php in Aratix 0.2.2 beta 11 and earlier, when register_globals i
23RIESGO
abrir ↗
← anteriorpágina 320 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.