Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados

40.553CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.327 exploits

Referência

CVE-2026-93959

CVE-2026-93959MEDIUM

SourceCodester Online Reviewer Management System btn_functions.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-14844

CVE-2026-14844MEDIUM

Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes

33RIESGO

abrir ↗

Referência

CVE-2026-92425

CVE-2026-92425MEDIUM

Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR

33RIESGO

abrir ↗

Referência✓ VexDay Proof

SanyBee Gallery 0.1.1 - 'p' Local File Inclusion

CVE-2007-6648—webappsphp

Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and

23RIESGO

abrir ↗

Referência✓ VexDay Proof

XRms 1.99.2 - Remote File Inclusion / Cross-Site Scripting / Information Gathering

CVE-2008-3398—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web sc

23RIESGO

abrir ↗

Referência

CVE-2012-3810

CVE-2012-3810—

Samsung Kies before 2.5.0.12094_27_11 has registry modification.

23RIESGO

abrir ↗

Referência

CVE-2013-2619

CVE-2013-2619—

Directory traversal vulnerability in Aspen before 0.22 allows remote attackers to read arbitrary files via a .. (dot dot

23RIESGO

abrir ↗

Referência

CVE-2018-9237

CVE-2018-9237—

iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.

23RIESGO

abrir ↗

Referência

CVE-2018-9238

CVE-2018-9238—

proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-85350

CVE-2026-85350MEDIUM

UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together

33RIESGO

abrir ↗

Referência

CVE-2026-16051

CVE-2026-16051CRITICAL

WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action

48RIESGO

abrir ↗

Referência✓ VexDay Proof

Dayfox Blog 4 - Multiple Local File Inclusions

CVE-2008-3564—webappsphp

Multiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute

23RIESGO

abrir ↗

Referência

CVE-2023-54399

CVE-2023-54399CRITICAL

Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree

48RIESGO

abrir ↗

Referência

CVE-2026-16557

CVE-2026-16557MEDIUM

Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins

33RIESGO

abrir ↗

Referência

CVE-2023-54399

CVE-2023-54399CRITICAL

Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree

48RIESGO

abrir ↗

Referência

CVE-2026-85703

CVE-2026-85703MEDIUM

ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resources

33RIESGO

abrir ↗

Referência

Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE

CVE-2025-1097HIGHremotemultiple

ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

68RIESGO

abrir ↗

Referência

CVE-2026-18037

CVE-2026-18037MEDIUM

Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

33RIESGO

abrir ↗

Referência

CVE-2026-16293

CVE-2026-16293MEDIUM

Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL

33RIESGO

abrir ↗

Referência

CVE-2026-16589

CVE-2026-16589HIGH

WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter

41RIESGO

abrir ↗

Referência

CVE-2026-85702

CVE-2026-85702MEDIUM

ramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication

33RIESGO

abrir ↗

Referência

CVE-2026-80116

CVE-2026-80116HIGH

PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL

41RIESGO

abrir ↗

Referência✓ VexDay Proof

Mihalism Multi Forum Host 3.0.x - Remote File Inclusion

CVE-2007-6657—webappsphp

PHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier

23RIESGO

abrir ↗

Referência

CVE-2026-85637

CVE-2026-85637MEDIUM

jofpin trape Admin Endpoint sockets.py join_room missing authentication

33RIESGO

abrir ↗

Referência✓ VexDay Proof

VideoLAN VLC Media Player 0.8.6i - '.tta' File Parsing Heap Overflow (PoC)

CVE-2008-3732—dosmultiple

Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause

28RIESGO

abrir ↗

Referência

CVE-2026-8256

CVE-2026-8256MEDIUM

Devs Palace ERP Online mr-save cross site scripting

33RIESGO

abrir ↗

Referência✓ VexDay Proof

Active PHP BookMarks 1.1.02 - SQL Injection

CVE-2008-3748—webappsphp

SQL injection vulnerability in view_group.php in Active PHP Bookmarks (APB) 1.1.02 and 1.2.06 allows remote attackers to

23RIESGO

abrir ↗

Referência

CVE-2011-1099

CVE-2011-1099—

Multiple directory traversal vulnerabilities in FocalMedia.Net Quick Polls before 1.0.2 allow remote attackers to (1) re

23RIESGO

abrir ↗

Referência

CVE-2026-8255

CVE-2026-8255MEDIUM

Devs Palace ERP Online add_new_customer cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-8251

CVE-2026-8251MEDIUM

Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.