Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.166exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.078VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2018-11671
CVE-2018-11671—
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php
23RIESGO
abrir ↗
Referência
CVE-2020-37241
CVE-2020-37241MEDIUM
bloofoxCMS 0.5.2.1 Cross-Site Request Forgery via user add
33RIESGO
abrir ↗
Referência
CVE-2026-84289
CVE-2026-84289MEDIUM
NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation
33RIESGO
abrir ↗
Referência
CVE-2026-3073
CVE-2026-3073MEDIUM
Authorization Bypass Through User-Controlled Key in GitLab
33RIESGO
abrir ↗
Referência
CVE-2026-7377
CVE-2026-7377HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RIESGO
abrir ↗
Referência
CVE-2026-7481
CVE-2026-7481HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RIESGO
abrir ↗
Referência
CVE-2026-84431
CVE-2026-84431MEDIUM
AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-84696
CVE-2026-84696CRITICAL
Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands
48RIESGO
abrir ↗
Referência
CVE-2026-84287
CVE-2026-84287MEDIUM
NousResearch hermes-agent Session Chat api_server.py denial of service
33RIESGO
abrir ↗
Referência
CVE-2017-14798
CVE-2017-14798HIGH
local privilege escalation in SUSE postgresql init script
41RIESGO
abrir ↗
Referência
Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection
CVE-2020-15255HIGHwebappsphp
CSV injection in Anuko Time Tracker
41RIESGO
abrir ↗
Referência
CVE-2005-2428
CVE-2005-2428—
Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hid
60RIESGO
abrir ↗
Referência
CVE-2026-8207
CVE-2026-8207HIGH
Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/gr
41RIESGO
abrir ↗
Referência
CVE-2026-103543
CVE-2026-103543MEDIUM
itsourcecode Leave Management System controller.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2021-47929
CVE-2021-47929MEDIUM
WordPress Plugin Filterable Portfolio Gallery 1.0 Stored XSS
33RIESGO
abrir ↗
Referência
CVE-2021-47928
CVE-2021-47928HIGH
Opencart TMD Vendor System 3.x Blind SQL Injection via product route
41RIESGO
abrir ↗
Referência
CVE-2021-47923
CVE-2021-47923CRITICAL
OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie
48RIESGO
abrir ↗
Referência
CVE-2011-5204
CVE-2011-5204—
Akiva WebBoard 8.x stores passwords in plaintext, which allows local users to obtain sensitive information by reading fr
23RIESGO
abrir ↗
Referência
CVE-2017-14839
CVE-2017-14839—
TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.
23RIESGO
abrir ↗
Referência
CVE-2026-14607
CVE-2026-14607MEDIUM
RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption
33RIESGO
abrir ↗
Referência
CVE-2018-15844
CVE-2018-15844—
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's pas
23RIESGO
abrir ↗
Referência
CVE-2026-90801
CVE-2026-90801MEDIUM
GNU Binutils ld cache.c cache_bwrite buffer overflow
33RIESGO
abrir ↗
Referência
CVE-2018-18797
CVE-2018-18797—
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RIESGO
abrir ↗
Referência
CVE-2014-8687
CVE-2014-8687—
Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root
50RIESGO
abrir ↗
Referência
CVE-2026-19709
CVE-2026-19709MEDIUM
Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
33RIESGO
abrir ↗
Referência
CVE-2011-5283
CVE-2011-5283—
Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Expre
23RIESGO
abrir ↗
Referência
CVE-2026-75087
CVE-2026-75087MEDIUM
itsourcecode Hospital Management System viewdepartment.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2011-5283
CVE-2011-5283—
Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Expre
23RIESGO
abrir ↗
Referência
CVE-2026-75876
CVE-2026-75876MEDIUM
xianrendzw EasyReport Move Operations ModuleController.java sql injection
33RIESGO
abrir ↗
Referência
CVE-2018-18798
CVE-2018-18798—
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph
23RIESGO
abrir ↗
← anteriorpágina 511 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.