Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2017-15081
CVE-2017-15081—
In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
23RIESGO
abrir ↗
Referência
CVE-2017-17562
CVE-2017-17562HIGHbajo ataque
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Fastpublish CMS 1.6.9 - config[fsBase] Remote File Inclusion
CVE-2006-2726—webappsphp
PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files vi
28RIESGO
abrir ↗
Referência
CVE-2019-5420
CVE-2019-5420—
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess th
60RIESGO
abrir ↗
Referência✓ VexDay Proof
aspWebLinks 2.0 - SQL Injection / Admin Pass Change
CVE-2006-2847—webappsasp
SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands vi
23RIESGO
abrir ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALbajo ataque
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗
Referência
CVE-2026-12583
CVE-2026-12583HIGH
Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field
41RIESGO
abrir ↗
Referência
CVE-2026-15619
CVE-2026-15619MEDIUM
mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-15668
CVE-2026-15668MEDIUM
louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALbajo ataque
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALbajo ataque
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗
Referência
CVE-2026-12516
CVE-2026-12516MEDIUM
Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Media Proxy
33RIESGO
abrir ↗
Referência
CVE-2017-0285
CVE-2017-0285—
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT
23RIESGO
abrir ↗
Referência
CVE-2017-16945
CVE-2017-16945—
The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequen
23RIESGO
abrir ↗
Referência
CVE-2026-82554
CVE-2026-82554MEDIUM
SourceCodester Queue Management System add_customer.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-82487
CVE-2026-82487MEDIUM
Beetel 450TC3 password recovery
33RIESGO
abrir ↗
Referência
CVE-2026-10299
CVE-2026-10299MEDIUM
code-projects Online Hospital Management System viewdoctortimings.php resource injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
mxBB Module mx_modsdb 1.0 - Remote File Inclusion
CVE-2006-6560—webappsphp
PHP remote file inclusion vulnerability in includes/common.php in the mx_modsdb 1.0.0 module for MxBB (aka MX-System) Po
23RIESGO
abrir ↗
Referência
CVE-2026-11521
CVE-2026-11521MEDIUM
Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-12685
CVE-2026-12685HIGH
EscortWP <= 3.6.2 - Content Deletion via Vendor-Authored Backdoor
41RIESGO
abrir ↗
Referência★ 1
Proof of Concept for Reflected XSS in Lucee CFML (CVE-2026-29519)
CVE-2026-29519MEDIUM
Lucee CFML Server Reflected XSS via URL Path Parsing
33RIESGO
abrir ↗
Referência
CVE-2026-12276
CVE-2026-12276MEDIUM
LA-Studio Element Kit for Elementor < 1.6.1 - Unauthenticated Open Registration
33RIESGO
abrir ↗
Referência
CVE-2017-16962
CVE-2017-16962—
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities vi
23RIESGO
abrir ↗
Referência
CVE-2017-16994
CVE-2017-16994—
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, w
23RIESGO
abrir ↗
Referência
CVE-2026-82485
CVE-2026-82485MEDIUM
itsourcecode Sales and Inventory System pro_edit.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-12187
CVE-2026-12187HIGH
GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection
41RIESGO
abrir ↗
Referência
CVE-2017-17721
CVE-2017-17721—
CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, ass
23RIESGO
abrir ↗
Referência
CVE-2026-12186
CVE-2026-12186HIGH
GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection
41RIESGO
abrir ↗
Referência
CVE-2026-12223
CVE-2026-12223MEDIUM
Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection
33RIESGO
abrir ↗
Referência
CVE-2026-12219
CVE-2026-12219MEDIUM
Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection
33RIESGO
abrir ↗
← anteriorpágina 357 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.