Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.167exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.079VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-18682
CVE-2026-18682LOW
OpenAkita File Upload API upload cross site scripting
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities
CVE-2008-2216—webappsphp
Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows re
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Content Management System for Phprojekt 0.6.1 - File Disclosure
CVE-2008-2217—webappsphp
Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attac
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WebStudio eCatalogue - Blind SQL Injection
CVE-2008-5294—webappsphp
SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PG Real Estate - Authentication Bypass
CVE-2008-5306—webappsphp
SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência
CVE-2026-120190
CVE-2026-120190MEDIUM
PostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2021-24145
CVE-2021-24145—
Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE
60RIESGO
abrir ↗
Referência
Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE
CVE-2025-24514HIGHremotemultiple
ingress-nginx controller - configuration injection via unsanitized auth-url annotation
68RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Nuke 7.9 - 'Encyclopedia' SQL Injection
CVE-2006-5525—webappsphp
Incomplete blacklist vulnerability in mainfile.php in PHP-Nuke 7.9 and earlier allows remote attackers to conduct SQL in
23RIESGO
abrir ↗
Referência
CVE-2026-93650
CVE-2026-93650MEDIUM
Saleor throttling.py get_client_ip excessive authentication
33RIESGO
abrir ↗
Referência✓ VexDay Proof
OTSCMS 2.1.3 - Multiple Remote File Inclusions
CVE-2006-5548—webappsphp
PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 2.0
23RIESGO
abrir ↗
Referência✓ VexDay Proof
QK SMTP 3.01 - 'RCPT TO' Remote Denial of Service
CVE-2006-5551—doswindows
Stack-based buffer overflow in QK SMTP 3.01 and earlier might allow remote attackers to execute arbitrary code via a lon
23RIESGO
abrir ↗
Referência✓ VexDay Proof
QuickUpCMS - Multiple SQL Injections Vulnerabilities
CVE-2008-2530—webappsphp
Multiple SQL injection vulnerabilities in Concepts & Solutions QuickUpCMS allow remote attackers to execute arbitrary SQ
23RIESGO
abrir ↗
Referência
CVE-2026-16653
CVE-2026-16653MEDIUM
boazsegev facil.io Public Folder http.c http_sendfile2 path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-115277
CVE-2026-115277MEDIUM
WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-93532
CVE-2026-93532MEDIUM
gedelumbung HospitalManagement Password Change password.php simpan improper authentication
33RIESGO
abrir ↗
Referência
CVE-2026-88994
CVE-2026-88994MEDIUM
All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes
33RIESGO
abrir ↗
Referência
CVE-2026-12968
CVE-2026-12968HIGH
Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload
41RIESGO
abrir ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-11579
CVE-2026-11579MEDIUM
Kali Forms < 2.4.17 - Unauthenticated Media Upload
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Nitro Web Gallery 1.4.3 - 'section' SQL Injection
CVE-2008-2817—webappsphp
SQL injection vulnerability in albums.php in NiTrO Web Gallery 1.4.3 and earlier allows remote attackers to execute arbi
23RIESGO
abrir ↗
Referência
CVE-2026-38764
CVE-2026-38764HIGH
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kerne
41RIESGO
abrir ↗
Referência
CVE-2026-12869
CVE-2026-12869MEDIUM
Header Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template Import
33RIESGO
abrir ↗
Referência
CVE-2026-16331
CVE-2026-16331MEDIUM
D-Link DNS-320 save_ajax.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-8989
CVE-2026-8989HIGH
Open Recovery Mode
41RIESGO
abrir ↗
Referência
CVE-2026-16330
CVE-2026-16330MEDIUM
D-Link DNS-320 uploadify.php unrestricted upload
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Mybizz-Classifieds - 'cat' SQL Injection
CVE-2008-2845—webappsphp
SQL injection vulnerability in index.php in MyBizz-Classifieds allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2026-15907
CVE-2026-15907MEDIUM
H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
CaupoShop Classic 1.3 - 'saArticle[ID]' SQL Injection
CVE-2008-2866—webappsphp
SQL injection vulnerability in csc_article_details.php in Caupo.net CaupoShop Classic 1.3 allows remote attackers to exe
23RIESGO
abrir ↗
Referência
CVE-2026-104753
CVE-2026-104753MEDIUM
Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter
33RIESGO
abrir ↗
← anteriorpágina 514 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.