Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados

40.452CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.240 exploits

Referência

CVE-2011-5230

CVE-2011-5230—

Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/Log

23RIESGO

abrir ↗

Referência

CVE-2026-14315

CVE-2026-14315MEDIUM

Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission

33RIESGO

abrir ↗

Referência✓ VexDay Proof

Pixaria Gallery 1.x - 'class.Smarty.php' Remote File Inclusion

CVE-2007-2458—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arb

28RIESGO

abrir ↗

Referência

CVE-2010-4566

CVE-2010-4566—

The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and

43RIESGO

abrir ↗

Referência

CVE-2016-4177

CVE-2016-4177—

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632

28RIESGO

abrir ↗

Referência

CVE-2026-7705

CVE-2026-7705MEDIUM

JD Cloud JDCOS Service jdcap set_iptv_info command injection

33RIESGO

abrir ↗

Referência

CVE-2026-5335

CVE-2026-5335MEDIUM

Magic Export & Import < 1.2.0 - Unauthenticated PII Disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-7704

CVE-2026-7704MEDIUM

AV Stumpfl Pixera Two Media Server Service Port 1338 path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-7703

CVE-2026-7703MEDIUM

AV Stumpfl Pixera Two Media Server Websocket API code injection

33RIESGO

abrir ↗

Referência

CVE-2026-7702

CVE-2026-7702MEDIUM

toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization

33RIESGO

abrir ↗

Referência

CVE-2026-7699

CVE-2026-7699MEDIUM

Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-16250

CVE-2026-16250CRITICAL

Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

48RIESGO

abrir ↗

Referência

CVE-2026-7217

CVE-2026-7217MEDIUM

Deepractice PromptX Document File index.ts read_pdf absolute path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-7221

CVE-2026-7221MEDIUM

TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-7220

CVE-2026-7220MEDIUM

jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection

33RIESGO

abrir ↗

Referência✓ VexDay Proof

vcart 3.3.2 - Multiple Remote File Inclusions

CVE-2008-0287—webappsphp

PHP remote file inclusion vulnerability in VisionBurst vcart 3.3.2 allows remote attackers to execute arbitrary PHP code

23RIESGO

abrir ↗

Referência

CVE-2021-3394

CVE-2021-3394—

Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder per

23RIESGO

abrir ↗

Referência

CVE-2020-37226

CVE-2020-37226HIGH

Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby

41RIESGO

abrir ↗

Referência

CVE-2026-66006

CVE-2026-66006MEDIUM

lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

33RIESGO

abrir ↗

Referência✓ VexDay Proof

ImageAlbum 2.0.0b2 - 'id' SQL Injection

CVE-2008-0288—webappsphp

Multiple SQL injection vulnerabilities in ImageAlbum 2.0.0b2 allow remote attackers to execute arbitrary SQL commands vi

23RIESGO

abrir ↗

Referência

CVE-2016-4312

CVE-2016-4312—

XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH

23RIESGO

abrir ↗

Referência

CVE-2026-14819

CVE-2026-14819LOW

Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move

28RIESGO

abrir ↗

Referência✓ VexDay Proof

RichStrong CMS - 'cat' SQL Injection

CVE-2008-0291—webappsasp

SQL injection vulnerability in showproduct.asp in RichStrong CMS allows remote attackers to execute arbitrary SQL comman

23RIESGO

abrir ↗

Referência

CVE-2026-66005

CVE-2026-66005MEDIUM

Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

33RIESGO

abrir ↗

Referência

CVE-2026-14827

CVE-2026-14827MEDIUM

Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter

33RIESGO

abrir ↗

Referência

CVE-2026-65697

CVE-2026-65697MEDIUM

Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

33RIESGO

abrir ↗

Referência

CVE-2026-65696

CVE-2026-65696MEDIUM

Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API

33RIESGO

abrir ↗

Referência

CVE-2026-16194

CVE-2026-16194MEDIUM

zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-16156

CVE-2026-16156MEDIUM

SourceCodester Class and Exam Timetabling System forexam.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-65693

CVE-2026-65693HIGH

Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.