Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.449exploits catalogados
35.552CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.451Referência 22.367GitHub PoC 14.225VulnCheck XDB 8649Nuclei 4283Metasploit 3474✓ solo verificadosrecientespopularesriesgo
22.367 exploits
Referência
CVE-2026-34111
CVE-2026-34111CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php
48RIESGO
abrir ↗
Referência
CVE-2026-34105
CVE-2026-34105CRITICAL
Guardian Language-System Unauthenticated SQL Injection via id Parameter in translate_text.php
48RIESGO
abrir ↗
Referência
CVE-2026-34104
CVE-2026-34104CRITICAL
Guardian Language-System Unauthenticated SQL Injection via name Parameter in designer.php
48RIESGO
abrir ↗
Referência
CVE-2026-34100
CVE-2026-34100CRITICAL
Guardian Language-System Unauthenticated SQL Injection via id Parameter in media.php
48RIESGO
abrir ↗
Referência
CVE-2026-11887
CVE-2026-11887MEDIUM
Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass
33RIESGO
abrir ↗
Referência
CVE-2026-11570
CVE-2026-11570MEDIUM
User Submitted Posts < 20260608 - Unauthenticated Stored XSS via Author Name
33RIESGO
abrir ↗
Referência
CVE-2026-58448
CVE-2026-58448HIGH
yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API
41RIESGO
abrir ↗
Referência
CVE-2026-58447
CVE-2026-58447HIGH
Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check
41RIESGO
abrir ↗
Referência
CVE-2026-58446
CVE-2026-58446MEDIUM
Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint
33RIESGO
abrir ↗
Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2982—webappsphp
Multiple directory traversal vulnerabilities in HomePH Design 2.10 RC2, when register_globals is enabled, allow remote a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
cmreams CMS 1.3.1.1 beta2 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2985—webappsphp
Directory traversal vulnerability in load_language.php in CMReams CMS 1.3.1.1 Beta 2, when register_globals is enabled,
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpDMCA 1.0.0 - Multiple Remote File Inclusions
CVE-2008-2986—webappsphp
Multiple PHP remote file inclusion vulnerabilities in phpDMCA 1.0.0 allow remote attackers to execute arbitrary PHP code
23RIESGO
abrir ↗
Referência✓ VexDay Proof
FOG Forum 0.8.1 - Multiple Local File Inclusions
CVE-2008-2993—webappsphp
Multiple directory traversal vulnerabilities in index.php in FOG Forum 0.8.1 allow remote attackers to include and execu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPortal 1.2 - Multiple Remote File Inclusions
CVE-2008-3022—webappsphp
Multiple PHP remote file inclusion vulnerabilities in sablonlar/gunaysoft/gunaysoft.php in PHPortal 1.2 Beta allow remot
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Efestech Shop 2.0 - 'cat_id' SQL Injection
CVE-2008-3030—webappsphp
SQL injection vulnerability in default.asp in EfesTECH Shop 2.0 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Agenda 2.2.4 - 'index.php' Local File Inclusion
CVE-2008-3031—webappsphp
Directory traversal vulnerability in index.php in Simple PHP Agenda 2.2.4 and earlier allows remote attackers to include
23RIESGO
abrir ↗
Referência
CVE-2018-25437
CVE-2018-25437HIGH
WordPress CherryFramework Themes 3.1.4 Backup File Download
41RIESGO
abrir ↗
Referência
CVE-2018-25436
CVE-2018-25436CRITICAL
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 Arbitrary File Upload
48RIESGO
abrir ↗
Referência
CVE-2016-20067
CVE-2016-20067MEDIUM
WordPress CP Polls 1.0.8 Cross-Site Request Forgery
33RIESGO
abrir ↗
Referência
CVE-2026-34021
CVE-2026-34021HIGH
Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replay
41RIESGO
abrir ↗
Referência
CVE-2026-12200
CVE-2026-12200MEDIUM
Ritlabs TinyWeb Server Header libeay32.dll.html stack-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-1500
CVE-2026-1500MEDIUM
Allocation of Resources Without Limits or Throttling in GitLab
33RIESGO
abrir ↗
Referência
CVE-2026-3553
CVE-2026-3553LOW
Incorrect Authorization in GitLab
28RIESGO
abrir ↗
Referência
CVE-2026-6269
CVE-2026-6269MEDIUM
Incorrect Authorization in GitLab
33RIESGO
abrir ↗
Referência
CVE-2026-6277
CVE-2026-6277MEDIUM
Incorrect Authorization in GitLab
33RIESGO
abrir ↗
Referência
CVE-2026-6976
CVE-2026-6976LOW
Authorization Bypass Through User-Controlled Key in GitLab
28RIESGO
abrir ↗
Referência
CVE-2026-7250
CVE-2026-7250HIGH
Allocation of Resources Without Limits or Throttling in GitLab
41RIESGO
abrir ↗
Referência
CVE-2025-71329
CVE-2025-71329HIGH
image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
41RIESGO
abrir ↗
Referência
CVE-2025-71330
CVE-2025-71330HIGH
image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing
41RIESGO
abrir ↗
Referência
CVE-2021-47982
CVE-2021-47982MEDIUM
WordPress Plugin WP-Paginate 2.1.3 Stored XSS via preset
33RIESGO
abrir ↗
← anteriorpágina 470 / 746siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.