Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2017-15966
CVE-2017-15966—
The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid parame
23RIESGO
abrir ↗
Referência
CVE-2026-92418
CVE-2026-92418MEDIUM
ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2017-9748
CVE-2017-9748—
The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU
23RIESGO
abrir ↗
Referência
CVE-2018-0296
CVE-2018-0296HIGHbajo ataque
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remo
100RIESGO
abrir ↗
Referência
CVE-2018-1000001
CVE-2018-1000001—
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
43RIESGO
abrir ↗
Referência✓ VexDay Proof
Quintessential Player 4.50.1.82 - Playlist Denial of Service (PoC)
CVE-2006-6261—doswindows
Buffer overflow in Quintessential Player 4.50.1.82 and earlier allows remote attackers to cause a denial of service (cra
23RIESGO
abrir ↗
Referência
CVE-2026-13549
CVE-2026-13549MEDIUM
CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization
33RIESGO
abrir ↗
Referência
CVE-2026-13589
CVE-2026-13589MEDIUM
seladb PcapPlusPlus Telnet Subnegotiation Packet TelnetLayer.cpp getSubCommand heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-92398
CVE-2026-92398CRITICAL
Ruijie RG-EW3000GX user_list_note admin os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-13588
CVE-2026-13588MEDIUM
seladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2022-1388
CVE-2022-1388CRITICALbajo ataqueransomware
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RIESGO
abrir ↗
Referência
CVE-2026-58467
CVE-2026-58467HIGH
Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php
56RIESGO
abrir ↗
Referência
CVE-2026-10243
CVE-2026-10243MEDIUM
code-projects Smart Parking System Admin Endpoint missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-10123
CVE-2026-10123HIGH
TRENDnet TEW-432BRP formSetDomainFilter stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-10121
CVE-2026-10121HIGH
TRENDnet TEW-432BRP formSetUrlFilter stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2018-25422
CVE-2018-25422HIGH
MOGG web simulator Script All Version SQL Injection via play.php
41RIESGO
abrir ↗
Referência
CVE-2026-13587
CVE-2026-13587MEDIUM
seladb PcapPlusPlus LightPcapNg light_pcapng.c parse_by_block_type heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2014-7226
CVE-2014-7226—
The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2017-17614
CVE-2017-17614—
Food Order Script 1.0 has SQL Injection via the /list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-92397
CVE-2026-92397CRITICAL
Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-16953
CVE-2026-16953MEDIUM
AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie
33RIESGO
abrir ↗
Referência
CVE-2017-2460
CVE-2017-2460—
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RIESGO
abrir ↗
Referência
Booked Scheduler 2.7.5 - Remote Command Execution (Metasploit)
CVE-2019-9581—webappsphp
phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitra
28RIESGO
abrir ↗
Referência
CVE-2026-108686
CVE-2026-108686LOW
WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
28RIESGO
abrir ↗
Referência
CVE-2021-31674
CVE-2021-31674—
Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacke
23RIESGO
abrir ↗
Referência
CVE-2026-108685
CVE-2026-108685LOW
WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
28RIESGO
abrir ↗
Referência
CVE-2026-11531
CVE-2026-11531MEDIUM
imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-18468
CVE-2026-18468HIGH
Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header
41RIESGO
abrir ↗
Referência
CVE-2014-9148
CVE-2014-9148—
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update"
28RIESGO
abrir ↗
Referência
CVE-2014-9178
CVE-2014-9178—
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plu
23RIESGO
abrir ↗
← anteriorpágina 540 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.