Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados

40.452CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.240 exploits

Referência

CVE-2026-23751

CVE-2026-23751CRITICAL

Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting

48RIESGO

abrir ↗

Referência

CVE-2026-41460

CVE-2026-41460CRITICAL

SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall

48RIESGO

abrir ↗

Referência

CVE-2026-4512

CVE-2026-4512LOW

WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS

28RIESGO

abrir ↗

Referência

CVE-2026-4106

CVE-2026-4106MEDIUM

HT Mega < 3.0.7 – Unauthenticated PII Disclosure

48RIESGO

abrir ↗

Referência✓ VexDay Proof

Absolute Banner Manager - Insecure Cookie Handling

CVE-2008-6858—webappsphp

Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by sett

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Absolute Live Support 5.1 - Insecure Cookie Handling

CVE-2008-6864—webappsphp

Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative a

23RIESGO

abrir ↗

Referência

CVE-2009-4789

CVE-2009-4789—

Multiple PHP remote file inclusion vulnerabilities in the MojoBlog component RC 0.15 for Joomla! allow remote attackers

23RIESGO

abrir ↗

Referência

CVE-2010-4852

CVE-2010-4852—

Cross-site scripting (XSS) vulnerability in login.php in Eclime 1.1.2b allows remote attackers to inject arbitrary web s

23RIESGO

abrir ↗

Referência

CVE-2014-0869

CVE-2014-0869—

The decrypt function in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algori

23RIESGO

abrir ↗

Referência

CVE-2014-0871

CVE-2014-0871—

RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote att

23RIESGO

abrir ↗

Referência

CVE-2014-0997

CVE-2014-0997—

WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used i

23RIESGO

abrir ↗

Referência

CVE-2026-7676

CVE-2026-7676MEDIUM

kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-40500

CVE-2026-40500—

3RIESGO

abrir ↗

Referência

CVE-2026-14845

CVE-2026-14845MEDIUM

NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget

33RIESGO

abrir ↗

Referência

CVE-2026-14221

CVE-2026-14221LOW

Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization

28RIESGO

abrir ↗

Referência

CVE-2025-65133

CVE-2025-65133CRITICAL

A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated

48RIESGO

abrir ↗

Referência

CVE-2026-38533

CVE-2026-38533MEDIUM

An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attac

33RIESGO

abrir ↗

Referência

CVE-2026-7675

CVE-2026-7675HIGH

Shenzhen Libituo Technology LBT-T300-HW1 apply.cgi start_lan buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2026-66753

CVE-2026-66753MEDIUM

tiny-http 0.12.0 HTTP Response Splitting via Header Injection

33RIESGO

abrir ↗

Referência

CVE-2026-7673

CVE-2026-7673MEDIUM

crmeb_java Admin Upload UploadServiceImpl.java unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-7644

CVE-2026-7644MEDIUM

ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-39907

CVE-2026-39907HIGH

Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via WCF SOAP

41RIESGO

abrir ↗

Referência

CVE-2026-39906

CVE-2026-39906HIGH

Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting

41RIESGO

abrir ↗

Referência

CVE-2026-39808

CVE-2026-39808CRITICALbajo ataque

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

100RIESGO

abrir ↗

Referência

CVE-2026-7643

CVE-2026-7643MEDIUM

ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy

33RIESGO

abrir ↗

Referência

CVE-2026-7642

CVE-2026-7642MEDIUM

pskill9 website-downloader MCP index.ts download_website os command injection

33RIESGO

abrir ↗

Referência

CVE-2018-25291

CVE-2018-25291MEDIUM

Project64 2.3.2 Denial of Service via Plugin Directory

33RIESGO

abrir ↗

Referência

CVE-2018-25290

CVE-2018-25290MEDIUM

Easyboot 6.6.0 Buffer Overflow Denial of Service

33RIESGO

abrir ↗

Referência

CVE-2018-25289

CVE-2018-25289MEDIUM

Softdisk 3.0.3 Buffer Overflow Denial of Service

33RIESGO

abrir ↗

Referência

CVE-2018-25288

CVE-2018-25288MEDIUM

StyleWriter 1.0 Denial of Service via Pattern Input

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.