Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados

40.452CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.240 exploits

Referência

CVE-2026-14826

CVE-2026-14826LOW

Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR

28RIESGO

abrir ↗

Referência

CVE-2026-14825

CVE-2026-14825LOW

Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR

28RIESGO

abrir ↗

Referência

CVE-2017-8849

CVE-2017-8849—

smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount hel

23RIESGO

abrir ↗

Referência

CVE-2026-12271

CVE-2026-12271MEDIUM

Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-19244

CVE-2026-19244MEDIUM

HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control

33RIESGO

abrir ↗

Referência

CVE-2026-15618

CVE-2026-15618MEDIUM

mosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanism

33RIESGO

abrir ↗

Referência

CVE-2026-15528

CVE-2026-15528MEDIUM

lamaalrajih kicad-mcp path_validator.py protection mechanism

33RIESGO

abrir ↗

Referência

CVE-2026-14778

CVE-2026-14778MEDIUM

SourceCodester Onlne Examination & Learning Management System Enrollment Management ajax_enroll.php improper authorization

33RIESGO

abrir ↗

Referência✓ VexDay Proof

DESlock+ < 3.2.6 - 'DLMFDISK.sy's Local kernel Ring0 SYSTEM

CVE-2008-1140—localwindows

DLMFDISK.sys 1.2.0.27 in DESlock+ 3.2.6 and earlier allows local users to gain privileges via a certain DLKFDISK_IOCTL r

23RIESGO

abrir ↗

Referência

CVE-2026-15376

CVE-2026-15376MEDIUM

Eleveo Call Recording Software statisticReportAction.do improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-101075

CVE-2026-101075CRITICAL

Netcore NR289-GE Location Time location_time.cgi system os command injection

48RIESGO

abrir ↗

Referência

CVE-2026-74842

CVE-2026-74842MEDIUM

Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-14237

CVE-2026-14237HIGH

Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation

41RIESGO

abrir ↗

Referência

CVE-2026-15514

CVE-2026-15514MEDIUM

Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-17023

CVE-2026-17023MEDIUM

Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback

33RIESGO

abrir ↗

Referência

CVE-2026-19259

CVE-2026-19259MEDIUM

MZ Automation libiec61850 MMS Protocol Workflow iec61850_common.c MmsMapping_varAccessSpecToObjectReference heap-based overflow

33RIESGO

abrir ↗

Referência

CVE-2026-19245

CVE-2026-19245MEDIUM

HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure

33RIESGO

abrir ↗

Referência

CVE-2019-25752

CVE-2019-25752HIGH

Joomla! Component J-BusinessDirectory 4.9.7 SQL Injection

41RIESGO

abrir ↗

Referência

CVE-2026-14239

CVE-2026-14239HIGH

Tourmaster < 5.4.8 - Stored XSS via CSRF

41RIESGO

abrir ↗

Referência

CVE-2017-17611

CVE-2017-17611—

Doctor Search Script 1.0 has SQL Injection via the /list city parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-65700

CVE-2026-65700CRITICAL

h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API

48RIESGO

abrir ↗

Referência

CVE-2026-67201

CVE-2026-67201HIGH

V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http

41RIESGO

abrir ↗

Referência

CVE-2018-14533

CVE-2018-14533—

read_tmp and write_tmp in Inteno IOPSYS allow attackers to gain privileges after writing to /tmp/etc/smb.conf because /v

23RIESGO

abrir ↗

Referência

CVE-2017-9810

CVE-2017-9810—

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Mai

23RIESGO

abrir ↗

Referência

CVE-2015-4027

CVE-2015-4027—

The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users t

23RIESGO

abrir ↗

Referência

CVE-2018-14575

CVE-2018-14575—

Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CS

23RIESGO

abrir ↗

Referência

CVE-2020-37252

CVE-2020-37252HIGH

Realtek Audio Service 1.0.0.55 Unquoted Service Path Privilege Escalation

41RIESGO

abrir ↗

Referência✓ VexDay Proof

Vivvo Article Manager 3.2 - 'classified_path' File Inclusion

CVE-2006-4714—webappsphp

PHP remote file inclusion vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 an

23RIESGO

abrir ↗

Referência

CVE-2026-15360

CVE-2026-15360CRITICAL

Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

48RIESGO

abrir ↗

Referência

CVE-2026-14660

CVE-2026-14660MEDIUM

code-projects Online Job Portal login.php sql injection

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.