Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados

40.553CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.327 exploits

Referência

CVE-2017-15971

CVE-2017-15971—

Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php send

23RIESGO

abrir ↗

Referência

CVE-2021-40379

CVE-2021-40379—

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 doe

28RIESGO

abrir ↗

Referência

CVE-2017-17576

CVE-2017-17576—

FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or se

23RIESGO

abrir ↗

Referência

CVE-2017-17578

CVE-2017-17578—

FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-78051

CVE-2026-78051MEDIUM

alexta69 MeTube Cookie File cookies.txt file access

33RIESGO

abrir ↗

Referência

CVE-2026-18356

CVE-2026-18356LOW

Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email

28RIESGO

abrir ↗

Referência

CVE-2026-78057

CVE-2026-78057MEDIUM

sambitraj Student-Management-System Management Mutation sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-17559

CVE-2026-17559MEDIUM

Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass

33RIESGO

abrir ↗

Referência✓ VexDay Proof

File Store PRO 3.2 - Multiple Blind SQL Injections

CVE-2006-1278—webappsphp

SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via th

23RIESGO

abrir ↗

Referência

CVE-2026-78050

CVE-2026-78050CRITICAL

Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow

48RIESGO

abrir ↗

Referência✓ VexDay Proof

PHP iCalendar 2.21 - 'publish.ical.php' Remote Code Execution

CVE-2006-1291—webappsphp

publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write acce

23RIESGO

abrir ↗

Referência

CVE-2026-77002

CVE-2026-77002CRITICAL

SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass

48RIESGO

abrir ↗

Referência

CVE-2026-77001

CVE-2026-77001CRITICAL

Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass

48RIESGO

abrir ↗

Referência

CVE-2026-13176

CVE-2026-13176LOW

Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery

28RIESGO

abrir ↗

Referência

CVE-2026-77686

CVE-2026-77686MEDIUM

Dolibarr Account card.php improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-77681

CVE-2026-77681MEDIUM

CodeAstro Online Job Portal update-profile.php unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2016-10033

CVE-2016-10033CRITICALbajo ataque

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RIESGO

abrir ↗

Referência

CVE-2026-70667

CVE-2026-70667MEDIUM

Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)

33RIESGO

abrir ↗

Referência

CVE-2026-16595

CVE-2026-16595MEDIUM

WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-15215

CVE-2026-15215HIGH

Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation

41RIESGO

abrir ↗

Referência

CVE-2017-17605

CVE-2017-17605—

Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.

23RIESGO

abrir ↗

Referência

CVE-2017-17609

CVE-2017-17609—

Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.

23RIESGO

abrir ↗

Referência

CVE-2020-14882

CVE-2020-14882CRITICALbajo ataque

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RIESGO

abrir ↗

Referência

CVE-2026-19049

CVE-2026-19049HIGH

ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie

41RIESGO

abrir ↗

Referência

CVE-2020-14882

CVE-2020-14882CRITICALbajo ataque

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RIESGO

abrir ↗

Referência✓ VexDay Proof

Light Weight Calendar 1.x - 'date' Remote Code Execution

CVE-2006-1252—webappsphp

Eval injection vulnerability in cal.php in Light Weight Calendar (LWC) 1.0 allows remote attackers to execute arbitrary

23RIESGO

abrir ↗

Referência

CVE-2026-15214

CVE-2026-15214MEDIUM

Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-15032

CVE-2026-15032MEDIUM

wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion

33RIESGO

abrir ↗

Referência

CVE-2022-50964

CVE-2022-50964MEDIUM

uBidAuction 2.0.1 myAuctions loose Reflected XSS

33RIESGO

abrir ↗

Referência

CVE-2022-50964

CVE-2022-50964MEDIUM

uBidAuction 2.0.1 myAuctions loose Reflected XSS

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.