Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2026-15385
CVE-2026-15385MEDIUM
RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS
33RIESGO
abrir ↗
Referência
CVE-2026-103090
CVE-2026-103090HIGH
Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
41RIESGO
abrir ↗
Referência
CVE-2026-87069
CVE-2026-87069LOW
Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
28RIESGO
abrir ↗
Referência
CVE-2026-94096
CVE-2026-94096CRITICAL
Netcore NBR200V2 LAN IP Configuration network_tools command injection
48RIESGO
abrir ↗
Referência
CVE-2026-86183
CVE-2026-86183MEDIUM
diem-project diem dmWidget BasedmWidgetActions.class.php authorization
33RIESGO
abrir ↗
Referência
CVE-2026-81737
CVE-2026-81737HIGH
FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information
41RIESGO
abrir ↗
Referência
CVE-2026-82596
CVE-2026-82596MEDIUM
LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption
33RIESGO
abrir ↗
Referência
CVE-2026-19345
CVE-2026-19345MEDIUM
code-projects Task Management System UpdateTaskStatus.php authorization
33RIESGO
abrir ↗
Referência
CVE-2026-18722
CVE-2026-18722MEDIUM
diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization
33RIESGO
abrir ↗
Referência
CVE-2026-16057
CVE-2026-16057MEDIUM
Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
33RIESGO
abrir ↗
Referência
CVE-2026-77884
CVE-2026-77884HIGH
Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure
41RIESGO
abrir ↗
Referência
CVE-2026-19862
CVE-2026-19862MEDIUM
JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
33RIESGO
abrir ↗
Referência
CVE-2026-86209
CVE-2026-86209MEDIUM
SourceCodester Class and Exam Timetabling System delete_user.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-112152
CVE-2026-112152MEDIUM
vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-112086
CVE-2026-112086MEDIUM
ESPnet Inference Model inference_model.py build_model deserialization
33RIESGO
abrir ↗
Referência
CVE-2026-106933
CVE-2026-106933MEDIUM
Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
33RIESGO
abrir ↗
Referência
CVE-2026-106028
CVE-2026-106028MEDIUM
ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation
33RIESGO
abrir ↗
Referência
CVE-2026-111874
CVE-2026-111874MEDIUM
OpenCATS Career Portal CareersUI.php processLogin excessive authentication
33RIESGO
abrir ↗
Referência
CVE-2019-19781
CVE-2019-19781CRITICALbajo ataqueransomware
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RIESGO
abrir ↗
Referência
CVE-2019-19781
CVE-2019-19781CRITICALbajo ataqueransomware
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RIESGO
abrir ↗
Referência
CVE-2016-1542
CVE-2016-1542—
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and U
60RIESGO
abrir ↗
Referência✓ VexDay Proof
HIOX Browser Statistics 2.0 - Remote File Inclusion
CVE-2008-3402—webappsphp
Multiple PHP remote file inclusion vulnerabilities in HIOX Browser Statistics (HBS) 2.0 allow remote attackers to execut
23RIESGO
abrir ↗
Referência
CVE-2012-2156
CVE-2012-2156—
Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbi
23RIESGO
abrir ↗
Referência
CVE-2004-2466
CVE-2004-2466—
chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username
60RIESGO
abrir ↗
Referência
CVE-2004-2466
CVE-2004-2466—
chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username
60RIESGO
abrir ↗
Referência
CVE-2015-2080
CVE-2015-2080—
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive informat
60RIESGO
abrir ↗
Referência✓ VexDay Proof
CoolPlayer 2.18 - '.m3u' File Local Buffer Overflow
CVE-2008-3408—localwindows
Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to ex
23RIESGO
abrir ↗
Referência
CVE-2016-1542
CVE-2016-1542—
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and U
60RIESGO
abrir ↗
Referência
CVE-2019-11358
CVE-2019-11358—
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
45RIESGO
abrir ↗
Referência
CVE-2019-11358
CVE-2019-11358—
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
45RIESGO
abrir ↗
← anteriorpágina 364 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.