Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.164exploits catalogados

40.551CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.327Exploit-DB 24.488GitHub PoC 18.076VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.327 exploits

Referência

CVE-2021-30150

CVE-2021-30150—

Composr 10.0.36 allows XSS in an XML script.

23RIESGO

abrir ↗

Referência

CVE-2021-3018

CVE-2021-3018—

ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the

43RIESGO

abrir ↗

Referência

CVE-2026-8208

CVE-2026-8208HIGH

Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the re

41RIESGO

abrir ↗

Referência

CVE-2011-5230

CVE-2011-5230—

Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/Log

23RIESGO

abrir ↗

Referência

CVE-2026-14315

CVE-2026-14315MEDIUM

Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission

33RIESGO

abrir ↗

Referência✓ VexDay Proof

Pixaria Gallery 1.x - 'class.Smarty.php' Remote File Inclusion

CVE-2007-2458—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arb

28RIESGO

abrir ↗

Referência

CVE-2010-4566

CVE-2010-4566—

The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and

43RIESGO

abrir ↗

Referência

CVE-2016-4177

CVE-2016-4177—

Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632

28RIESGO

abrir ↗

Referência

CVE-2026-7705

CVE-2026-7705MEDIUM

JD Cloud JDCOS Service jdcap set_iptv_info command injection

33RIESGO

abrir ↗

Referência

CVE-2026-5335

CVE-2026-5335MEDIUM

Magic Export & Import < 1.2.0 - Unauthenticated PII Disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-7704

CVE-2026-7704MEDIUM

AV Stumpfl Pixera Two Media Server Service Port 1338 path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-7703

CVE-2026-7703MEDIUM

AV Stumpfl Pixera Two Media Server Websocket API code injection

33RIESGO

abrir ↗

Referência

CVE-2026-7702

CVE-2026-7702MEDIUM

toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization

33RIESGO

abrir ↗

Referência

CVE-2026-7699

CVE-2026-7699MEDIUM

Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-16250

CVE-2026-16250CRITICAL

Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

48RIESGO

abrir ↗

Referência

CVE-2026-15543

CVE-2026-15543HIGH

Tenda CH22 CertListInfo formCertListInfo buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2026-7092

CVE-2026-7092MEDIUM

code-projects Invoice System in Laravel Profile profile improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-7091

CVE-2026-7091MEDIUM

code-projects Invoice System in Laravel User Management user improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-7090

CVE-2026-7090MEDIUM

code-projects Chat System send_message.php cross site scripting

33RIESGO

abrir ↗

Referência✓ VexDay Proof

SCO UnixWare < 7.1.4 p534589 - 'pkgadd' Local Privilege Escalation

CVE-2008-0310—localsco

Directory traversal vulnerability in pkgadd in SCO UnixWare 7.1.4 before p534589 allows local users to create or append

23RIESGO

abrir ↗

Referência

CVE-2013-6627

CVE-2013-6627—

net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1x

23RIESGO

abrir ↗

Referência

WordPress Madara - Local File Inclusion

CVE-2025-4524CRITICALwebappsmultiple

Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion

68RIESGO

abrir ↗

Referência

CVE-2026-7089

CVE-2026-7089MEDIUM

code-projects Home Service System Appointment Booking booking.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-7088

CVE-2026-7088MEDIUM

SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-7087

CVE-2026-7087MEDIUM

SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-7086

CVE-2026-7086MEDIUM

HBAI-Ltd Toonflow-app Storyboard Export replaceUrl.ts updateStoryboardUrl path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-7099

CVE-2026-7099HIGH

Tenda F456 httpd QuickIndex formQuickIndex buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2026-7093

CVE-2026-7093MEDIUM

code-projects Invoice System in Laravel Invoice Endpoint invoice improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-15525

CVE-2026-15525MEDIUM

kLOsk adloop write.py _validate_urls server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-7085

CVE-2026-7085LOW

HBAI-Ltd Toonflow-app downloadApp Endpoint downloadApp.ts z.url path traversal

28RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.