Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2017-10661
CVE-2017-10661—
Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denia
28RIESGO
abrir ↗
Referência
CVE-2026-18852
CVE-2026-18852MEDIUM
epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition
33RIESGO
abrir ↗
Referência
CVE-2026-18856
CVE-2026-18856MEDIUM
Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery
33RIESGO
abrir ↗
Referência
ManageEngine Service Desk 10.0 - Cross-Site Scripting
CVE-2019-15083—webappsjava
Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workst
23RIESGO
abrir ↗
Referência
CVE-2017-15957
CVE-2017-15957—
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
23RIESGO
abrir ↗
Referência
LSoft ListServ < 16.5-2018a - Cross-Site Scripting
CVE-2019-15501—webappswindows
Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.
38RIESGO
abrir ↗
Referência
CVE-2017-15959
CVE-2017-15959—
Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-200
23RIESGO
abrir ↗
Referência
CVE-2017-15983
CVE-2017-15983—
MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing
23RIESGO
abrir ↗
Referência
CVE-2026-18903
CVE-2026-18903MEDIUM
yeqifu warehouse FileController.java path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-18902
CVE-2026-18902HIGH
H3C NX15 esps repeaterproc command injection
41RIESGO
abrir ↗
Referência
CVE-2025-10903
CVE-2025-10903MEDIUM
Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
33RIESGO
abrir ↗
Referência
CVE-2017-1129
CVE-2017-1129—
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it coul
50RIESGO
abrir ↗
Referência
CVE-2026-15539
CVE-2026-15539MEDIUM
SourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-15319
CVE-2026-15319MEDIUM
Sipeed PicoClaw Launcher access_control.go IPAllowlist access control
33RIESGO
abrir ↗
Referência
CVE-2017-17620
CVE-2017-17620—
Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-61460
CVE-2026-61460HIGH
Krayin CRM Insecure Direct Object Reference via Controllers
41RIESGO
abrir ↗
Referência
CVE-2026-15185
CVE-2026-15185MEDIUM
GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds
33RIESGO
abrir ↗
Referência
CVE-2026-3035
CVE-2026-3035MEDIUM
Authentication Bypass Using an Alternate Path or Channel in GitLab
33RIESGO
abrir ↗
Referência
CVE-2026-15318
CVE-2026-15318MEDIUM
Sipeed PicoClaw MQTT Channel mqtt.go authorization
33RIESGO
abrir ↗
Referência
CVE-2014-6287
CVE-2014-6287CRITICALbajo ataque
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RIESGO
abrir ↗
Referência
CVE-2026-12517
CVE-2026-12517MEDIUM
Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Site Info Endpoint
33RIESGO
abrir ↗
Referência
CVE-2014-6287
CVE-2014-6287CRITICALbajo ataque
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RIESGO
abrir ↗
Referência
CVE-2019-2215
CVE-2019-2215HIGHbajo ataque
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗
Referência
CVE-2017-14219
CVE-2017-14219—
XSS (persistent) on the Intelbras Wireless N 150Mbps router with firmware WRN 240 allows attackers to steal wireless cre
23RIESGO
abrir ↗
Referência
CVE-2015-1518
CVE-2015-1518—
SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before 2.3.0 allows remote
23RIESGO
abrir ↗
Referência
CVE-2026-84023
CVE-2026-84023MEDIUM
BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF
33RIESGO
abrir ↗
Referência
CVE-2026-8378
CVE-2026-8378MEDIUM
Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename
33RIESGO
abrir ↗
Referência
CVE-2017-16807
CVE-2017-16807—
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exist
23RIESGO
abrir ↗
Referência
CVE-2026-56788
CVE-2026-56788MEDIUM
RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri
33RIESGO
abrir ↗
Referência
CVE-2019-3398
CVE-2019-3398HIGHbajo ataque
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote at
100RIESGO
abrir ↗
← anteriorpágina 458 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.