Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path
CVE-2022-35899—localwindows
There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local
23RIESGO
abrir ↗
Referência
CVE-2026-115281
CVE-2026-115281MEDIUM
Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
33RIESGO
abrir ↗
Referência
CVE-2026-115224
CVE-2026-115224MEDIUM
Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
33RIESGO
abrir ↗
Referência
CVE-2026-113813
CVE-2026-113813MEDIUM
PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-115282
CVE-2026-115282MEDIUM
Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-118578
CVE-2026-118578MEDIUM
maotoumao MusicFreeDesktop Request Forwarder information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-118577
CVE-2026-118577MEDIUM
maotoumao MusicFreeDesktop Request Forwarder server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-113494
CVE-2026-113494LOW
GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
28RIESGO
abrir ↗
Referência
aiohttp 3.9.1 - directory traversal PoC
CVE-2024-23334MEDIUMwebappspython
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RIESGO
abrir ↗
Referência
CVE-2026-103372
CVE-2026-103372MEDIUM
Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-117514
CVE-2026-117514MEDIUM
oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-82808
CVE-2026-82808MEDIUM
Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials
33RIESGO
abrir ↗
Referência
CVE-2026-7487
CVE-2026-7487LOW
Access Control Check Implemented After Asset is Accessed in GitLab
28RIESGO
abrir ↗
Referência
CVE-2017-6542
CVE-2017-6542—
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large
28RIESGO
abrir ↗
Referência
CVE-2026-103331
CVE-2026-103331MEDIUM
UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret
33RIESGO
abrir ↗
Referência
CVE-2026-118275
CVE-2026-118275MEDIUM
a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption
33RIESGO
abrir ↗
Referência
CVE-2014-125136
CVE-2014-125136HIGH
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup
41RIESGO
abrir ↗
Referência
CVE-2026-1168
CVE-2026-1168HIGH
Allocation of Resources Without Limits or Throttling in GitLab
41RIESGO
abrir ↗
Referência
CVE-2017-8646
CVE-2017-8646—
Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in t
35RIESGO
abrir ↗
Referência
CVE-2024-8945
CVE-2024-8945MEDIUM
CodeCanyon RISE Ultimate Project Manager save sql injection
38RIESGO
abrir ↗
Referência
CVE-2026-92458
CVE-2026-92458MEDIUM
yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale
33RIESGO
abrir ↗
Referência
CVE-2026-76640
CVE-2026-76640HIGH
Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack
41RIESGO
abrir ↗
Referência
CVE-2026-92457
CVE-2026-92457HIGH
yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice
41RIESGO
abrir ↗
Referência
CVE-2026-75417
CVE-2026-75417HIGH
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within applicat
41RIESGO
abrir ↗
Referência
CVE-2026-77693
CVE-2026-77693HIGH
Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Eskolar CMS 0.9.0.0 - Blind SQL Injection
CVE-2006-3727—webappsphp
Multiple SQL injection vulnerabilities in Eskolar CMS 0.9.0.0 allow remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗
Referência
CVE-2026-75798
CVE-2026-75798MEDIUM
AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant
33RIESGO
abrir ↗
Referência
CVE-2026-16984
CVE-2026-16984MEDIUM
WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure
33RIESGO
abrir ↗
Referência
CVE-2015-6098
CVE-2015-6098—
Buffer overflow in the Network Driver Interface Standard (NDIS) implementation in Microsoft Windows Vista SP2, Windows S
23RIESGO
abrir ↗
Referência
CVE-2026-92456
CVE-2026-92456HIGH
yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints
41RIESGO
abrir ↗
← anteriorpágina 524 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.