Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2026-10077
CVE-2026-10077MEDIUM
YOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes
33RIESGO
abrir ↗
Referência
CVE-2026-58593
CVE-2026-58593HIGH
NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User
41RIESGO
abrir ↗
Referência
CVE-2016-20084
CVE-2016-20084MEDIUM
WordPress appointment-booking-calendar 1.1.24 Privilege Escalation XSS
33RIESGO
abrir ↗
Referência
CVE-2026-12774
CVE-2026-12774MEDIUM
BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2016-20083
CVE-2016-20083MEDIUM
WordPress More Fields Plugin 2.1 Cross-Site Request Forgery
33RIESGO
abrir ↗
Referência
CVE-2025-3248
CVE-2025-3248CRITICALbajo ataqueransomware
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RIESGO
abrir ↗
Referência
CVE-2016-20082
CVE-2016-20082MEDIUM
WordPress Plugin Abtest Local File Inclusion via abtest_admin.php
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Crafty Syntax Live Help 2.14.6 - 'department' SQL Injection
CVE-2008-3845—webappsphp
Multiple SQL injection vulnerabilities in Crafty Syntax Live Help (CSLH) 2.14.6 and earlier allow remote attackers to ex
23RIESGO
abrir ↗
Referência
CVE-2026-85122
CVE-2026-85122HIGH
Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion
41RIESGO
abrir ↗
Referência
CVE-2026-12771
CVE-2026-12771LOW
BerriAI litellm M2M JWT user_api_key_auth.py improper authorization
28RIESGO
abrir ↗
Referência
CVE-2022-50972
CVE-2022-50972CRITICAL
WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php
48RIESGO
abrir ↗
Referência
CVE-2026-12797
CVE-2026-12797MEDIUM
BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization
33RIESGO
abrir ↗
Referência
CVE-2026-114444
CVE-2026-114444MEDIUM
Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer
33RIESGO
abrir ↗
Referência
CVE-2026-12776
CVE-2026-12776MEDIUM
Montodel House-Rental-Management index.php houses sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-114443
CVE-2026-114443HIGH
Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code
41RIESGO
abrir ↗
Referência
CVE-2026-112094
CVE-2026-112094MEDIUM
michaelrsweet mxml mxml-file.c mxml_load_data use after free
33RIESGO
abrir ↗
Referência
CVE-2026-12188
CVE-2026-12188MEDIUM
Grit42 Grit GritEntityController grit_entity_controller.rb sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-25551
CVE-2026-25551HIGH
Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service
41RIESGO
abrir ↗
Referência
CVE-2026-10813
CVE-2026-10813LOW
LMCache KV Cache utils.py hex_hash_to_int16 weak hash
28RIESGO
abrir ↗
Referência
CVE-2018-17385
CVE-2018-17385—
SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radiu
23RIESGO
abrir ↗
Referência
CVE-2018-17385
CVE-2018-17385—
SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radiu
23RIESGO
abrir ↗
Referência
CVE-2021-28419
CVE-2021-28419—
The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Microsoft Windows - 'WRITE_ANDX' SMB Command Handling Kernel Denial of Service (Metasploit)
CVE-2008-4114—doswindows
srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1
50RIESGO
abrir ↗
Referência
CVE-2026-74923
CVE-2026-74923MEDIUM
Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Attachmax Dolphin 2.1.0 - Multiple Vulnerabilities
CVE-2008-4206—webappsphp
PHP remote file inclusion vulnerability in config.php in Attachmax Dolphin 2.1.0 and earlier, when register_globals is e
23RIESGO
abrir ↗
Referência
CVE-2026-10877
CVE-2026-10877MEDIUM
SourceCodester Ship Ferry Ticket Reservation System Admin Login login.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10876
CVE-2026-10876MEDIUM
SourceCodester Ship Ferry Ticket Reservation System admin improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-10870
CVE-2026-10870HIGH
Shibby Tomato Web UI rc start_dhcpc os command injection
41RIESGO
abrir ↗
Referência
CVE-2025-71316
CVE-2025-71316CRITICAL
SQLite sqldiff remote code execution via argument injection
48RIESGO
abrir ↗
Referência
CVE-2026-93310
CVE-2026-93310MEDIUM
O-RAN-SC SMO OAM VES Collector allocation of resources
33RIESGO
abrir ↗
← anteriorpágina 337 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.