Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.164exploits catalogados

40.551CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.327Exploit-DB 24.488GitHub PoC 18.076VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.327 exploits

Referência

CVE-2026-18990

CVE-2026-18990MEDIUM

letta-ai LettaBot API Status Route server.ts missing authentication

33RIESGO

abrir ↗

Referência

CVE-2026-11319

CVE-2026-11319MEDIUM

TickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivity

33RIESGO

abrir ↗

Referência

CVE-2026-76014

CVE-2026-76014MEDIUM

BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

33RIESGO

abrir ↗

Referência

CVE-2026-97227

CVE-2026-97227MEDIUM

NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

33RIESGO

abrir ↗

Referência

CVE-2026-92436

CVE-2026-92436MEDIUM

Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-73033

CVE-2026-73033HIGH

Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

41RIESGO

abrir ↗

Referência

CVE-2026-18962

CVE-2026-18962MEDIUM

WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization

33RIESGO

abrir ↗

Referência

CVE-2026-89006

CVE-2026-89006MEDIUM

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import

33RIESGO

abrir ↗

Referência

CVE-2026-19212

CVE-2026-19212MEDIUM

WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable

33RIESGO

abrir ↗

Referência

CVE-2026-16265

CVE-2026-16265MEDIUM

WP Maps < 4.9.7 - Subscriber+ Denial of Service

33RIESGO

abrir ↗

Referência

CVE-2026-18980

CVE-2026-18980MEDIUM

nearai ironclaw shell.rs classify_command_risk command injection

33RIESGO

abrir ↗

Referência

CVE-2026-112247

CVE-2026-112247MEDIUM

Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-100746

CVE-2026-100746MEDIUM

coollabsio Coolify GitHub App Setup redirect missing authentication

33RIESGO

abrir ↗

Referência

CVE-2015-2216

CVE-2015-2216—

SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to exec

23RIESGO

abrir ↗

Referência

CVE-2015-2223

CVE-2015-2223—

Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks

23RIESGO

abrir ↗

Referência

CVE-2015-2275

CVE-2015-2275—

Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to i

23RIESGO

abrir ↗

Referência

CVE-2026-14238

CVE-2026-14238MEDIUM

Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report

33RIESGO

abrir ↗

Referência

CVE-2026-112190

CVE-2026-112190MEDIUM

Webkul Aureus ERP composer.json insertion of sensitive information into debugging code

33RIESGO

abrir ↗

Referência

CVE-2026-112159

CVE-2026-112159MEDIUM

JumpServer Template Rendering os command injection

33RIESGO

abrir ↗

Referência

CVE-2026-89271

CVE-2026-89271MEDIUM

WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile

33RIESGO

abrir ↗

Referência

CVE-2026-108811

CVE-2026-108811MEDIUM

WMCMS index.php information disclosure

33RIESGO

abrir ↗

Referência

CVE-2025-15703

CVE-2025-15703LOW

WP Job Openings < 4.0.0 - Admin+ Stored XSS

28RIESGO

abrir ↗

Referência

CVE-2026-84167

CVE-2026-84167MEDIUM

Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-108799

CVE-2026-108799MEDIUM

jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-108891

CVE-2026-108891MEDIUM

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId

33RIESGO

abrir ↗

Referência

CVE-2022-24706

CVE-2022-24706CRITICALbajo ataque

Remote Code Execution Vulnerability in Packaging

100RIESGO

abrir ↗

Referência

CVE-2022-24706

CVE-2022-24706CRITICALbajo ataque

Remote Code Execution Vulnerability in Packaging

100RIESGO

abrir ↗

Referência

CVE-2026-108888

CVE-2026-108888MEDIUM

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls

33RIESGO

abrir ↗

Referência

CVE-2026-85118

CVE-2026-85118CRITICAL

AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion

48RIESGO

abrir ↗

Referência

CVE-2026-84261

CVE-2026-84261HIGH

click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.