Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2026-8378
CVE-2026-8378MEDIUM
Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename
33RIESGO
abrir ↗
Referência
CVE-2017-16807
CVE-2017-16807—
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exist
23RIESGO
abrir ↗
Referência
CVE-2026-56788
CVE-2026-56788MEDIUM
RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri
33RIESGO
abrir ↗
Referência
CVE-2019-3398
CVE-2019-3398HIGHbajo ataque
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote at
100RIESGO
abrir ↗
Referência
CVE-2026-81429
CVE-2026-81429HIGH
Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF
41RIESGO
abrir ↗
Referência
CVE-2026-12811
CVE-2026-12811MEDIUM
kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
fipsGallery 1.5 - 'index1.asp' SQL Injection
CVE-2006-6117—webappsasp
SQL injection vulnerability in index1.asp in fipsGallery 1.5 and earlier allows remote attackers to execute arbitrary SQ
23RIESGO
abrir ↗
Referência
CVE-2026-77752
CVE-2026-77752HIGH
Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Sisfo Kampus 0.8 - Remote File Inclusion / Download
CVE-2006-6137—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Sisfo Kampus 0.8 allow remote attackers to execute arbitrary PHP c
23RIESGO
abrir ↗
Referência
CVE-2012-5864
CVE-2012-5864—
Sinapsi eSolar Improper Authentication
48RIESGO
abrir ↗
Referência
CVE-2026-77705
CVE-2026-77705HIGH
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
41RIESGO
abrir ↗
Referência
CVE-2012-6039
CVE-2012-6039—
SQL injection vulnerability in view_comments.php in YABSoft Advanced Image Hosting (AIH) Script, possibly 2.3, allows re
23RIESGO
abrir ↗
Referência
CVE-2026-8071
CVE-2026-8071HIGH
Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass
41RIESGO
abrir ↗
Referência✓ VexDay Proof
JiRos FAQ Manager 1.0 - 'index.asp' SQL Injection
CVE-2006-6149—webappsphp
SQL injection vulnerability in index.asp in JiRos FAQ Manager 1.0 allows remote attackers to execute arbitrary SQL comma
23RIESGO
abrir ↗
Referência
CVE-2016-20065
CVE-2016-20065HIGH
Product Catalog 8 1.2 Plugin WordPress SQL Injection
41RIESGO
abrir ↗
Referência
CVE-2026-4986
CVE-2026-4986MEDIUM
WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery
33RIESGO
abrir ↗
Referência
CVE-2018-11646
CVE-2018-11646—
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon
50RIESGO
abrir ↗
Referência
CVE-2026-12208
CVE-2026-12208MEDIUM
jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution
33RIESGO
abrir ↗
Referência
CVE-2026-12207
CVE-2026-12207MEDIUM
medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection
33RIESGO
abrir ↗
Referência
CVE-2026-12201
CVE-2026-12201MEDIUM
IObit Malware Fighter DLL permission
33RIESGO
abrir ↗
Referência
CVE-2018-1201
CVE-2018-1201—
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and vers
23RIESGO
abrir ↗
Referência
CVE-2026-11556
CVE-2026-11556HIGH
Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection
41RIESGO
abrir ↗
Referência
CVE-2019-7440
CVE-2019-7440—
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_S
23RIESGO
abrir ↗
Referência
CVE-2019-7440
CVE-2019-7440—
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_S
23RIESGO
abrir ↗
Referência
CVE-2026-11620
CVE-2026-11620MEDIUM
TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation
33RIESGO
abrir ↗
Referência
CVE-2026-11618
CVE-2026-11618MEDIUM
DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authentication
33RIESGO
abrir ↗
Referência
CVE-2014-8948
CVE-2014-8948—
Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows re
23RIESGO
abrir ↗
Referência
CVE-2014-8949
CVE-2014-8949—
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2018-19276
CVE-2018-19276CRITICAL
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated use
85RIESGO
abrir ↗
Referência
CVE-2014-9632
CVE-2014-9632—
The TDI driver (avgtdix.sys) in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protec
23RIESGO
abrir ↗
← anteriorpágina 453 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.