Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.974exploits catalogados
40.449CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.040VulnCheck XDB 10.108Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2026-9512
CVE-2026-9512MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-12987
CVE-2026-12987HIGH
Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration
41RIESGO
abrir ↗
Referência
CVE-2026-9511
CVE-2026-9511MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-9498
CVE-2026-9498MEDIUM
Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
33RIESGO
abrir ↗
Referência
CVE-2026-14849
CVE-2026-14849LOW
Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files
28RIESGO
abrir ↗
Referência
CVE-2026-12906
CVE-2026-12906LOW
RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure
28RIESGO
abrir ↗
Referência
CVE-2020-8794
CVE-2020-8794—
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for mult
60RIESGO
abrir ↗
Referência✓ VexDay Proof
Mambo Component Ricette 1.0 - SQL Injection
CVE-2008-0841—webappsphp
SQL injection vulnerability in index.php in the Giorgio Nordo Ricette (com_ricette) 1.0 component for Joomla! and Mambo
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component com_clasifier - 'cat_id' SQL Injection
CVE-2008-0842—webappsphp
SQL injection vulnerability in index.php in the Classifier (com_clasifier) component for Joomla! allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2018-5981
CVE-2018-5981—
SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-15479
CVE-2026-15479MEDIUM
H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery
33RIESGO
abrir ↗
Referência
CVE-2026-16200
CVE-2026-16200MEDIUM
zevorn rt-claw RPC swarm.c claw_tool_invoke authorization
33RIESGO
abrir ↗
Referência
CVE-2025-15665
CVE-2025-15665MEDIUM
BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field
33RIESGO
abrir ↗
Referência
CVE-2020-8813
CVE-2020-8813—
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a
60RIESGO
abrir ↗
Referência
CVE-2021-40378
CVE-2021-40378—
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killp
28RIESGO
abrir ↗
Referência
CVE-2026-44195
CVE-2026-44195MEDIUM
OPNsense: Authentication lockout bypass
33RIESGO
abrir ↗
Referência
CVE-2018-12524
CVE-2018-12524—
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /lib/ provi
23RIESGO
abrir ↗
Referência
CVE-2026-108669
CVE-2026-108669MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search
33RIESGO
abrir ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RIESGO
abrir ↗
Referência
CVE-2026-13703
CVE-2026-13703MEDIUM
SEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule Disclosure
33RIESGO
abrir ↗
Referência
CVE-2018-14328
CVE-2018-14328—
Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensiti
28RIESGO
abrir ↗
Referência
Webrun 3.6.0.42 - 'P_0' SQL Injection
CVE-2021-43650—webappsmultiple
WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
BlogMe PHP 1.1 - 'comments.php' SQL Injection
CVE-2008-2175—webappsphp
SQL injection vulnerability in comments.php in Gamma Scripts BlogMe PHP 1.1 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RIESGO
abrir ↗
Referência✓ VexDay Proof
Cplinks 1.03 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-2180—webappsphp
Multiple SQL injection vulnerabilities in cpLinks 1.03, when magic_quotes_gpc is disabled, allow remote attackers to exe
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Online Rental Property Script 4.5 - 'pid' SQL Injection
CVE-2008-2190—webappsphp
SQL injection vulnerability in index.php in Online Rent (aka Online Rental Property Script) 4.5 and earlier allows remot
23RIESGO
abrir ↗
Referência✓ VexDay Proof
wPortfolio 0.3 - Admin Password Changing
CVE-2008-5221—webappsphp
The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not
23RIESGO
abrir ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RIESGO
abrir ↗
Referência
CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated)
CVE-2021-43701—webappsphp
CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/articl
23RIESGO
abrir ↗
Referência
CVE-2026-108634
CVE-2026-108634MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint
33RIESGO
abrir ↗
← anteriorpágina 324 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.