Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-5679
CVE-2026-5679MEDIUM
Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-5678
CVE-2026-5678MEDIUM
Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-5677
CVE-2026-5677MEDIUM
Totolink A7100RU cstecgi.cgi CsteSystem os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-5676
CVE-2026-5676MEDIUM
Totolink A8000R cstecgi.cgi setLanguageCfg missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-5675
CVE-2026-5675MEDIUM
itsourcecode Construction Management System Parameter borrowed_tool.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-5672
CVE-2026-5672MEDIUM
code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2014-6287
CVE-2014-6287CRITICALbajo ataque
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Exponent CMS 0.96.3 - 'view' Remote Command Execution
CVE-2006-4963—webappsphp
Directory traversal vulnerability in index.php in Exponent CMS 0.96.3 allows remote attackers to read and execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2026-74992
CVE-2026-74992MEDIUM
Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Nuke Module books SQL - 'cid' SQL Injection
CVE-2008-0827—webappsphp
SQL injection vulnerability in the Books module of PHP-Nuke allows remote attackers to execute arbitrary SQL commands vi
23RIESGO
abrir ↗
Referência
CVE-2012-3577
CVE-2012-3577—
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress
28RIESGO
abrir ↗
Referência
CVE-2026-58055
CVE-2026-58055MEDIUM
nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length
33RIESGO
abrir ↗
Referência
CVE-2026-19993
CVE-2026-19993MEDIUM
Webkul Bagisto RMA State Validation update-status behavioral workflow
33RIESGO
abrir ↗
Referência
CVE-2026-94094
CVE-2026-94094MEDIUM
OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-76582
CVE-2026-76582MEDIUM
TRENDnet TEW-821DAP ssi ping.cgi system command injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Gregarius 0.5.4 - SQL Injection
CVE-2008-3374—webappsphp
SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHbajo ataque
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RIESGO
abrir ↗
Referência
CVE-2026-19782
CVE-2026-19782MEDIUM
WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users
33RIESGO
abrir ↗
Referência
CVE-2026-15049
CVE-2026-15049HIGH
Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import
41RIESGO
abrir ↗
Referência
CVE-2013-2572
CVE-2013-2572—
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 d
28RIESGO
abrir ↗
Referência
CVE-2026-19812
CVE-2026-19812HIGH
TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2013-2572
CVE-2013-2572—
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 d
28RIESGO
abrir ↗
Referência
CVE-2013-2573
CVE-2013-2573—
A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cam
35RIESGO
abrir ↗
Referência
CVE-2018-9237
CVE-2018-9237—
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
23RIESGO
abrir ↗
Referência
CVE-2018-9238
CVE-2018-9238—
proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-85350
CVE-2026-85350MEDIUM
UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together
33RIESGO
abrir ↗
Referência
CVE-2026-16051
CVE-2026-16051CRITICAL
WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action
48RIESGO
abrir ↗
Referência✓ VexDay Proof
Dayfox Blog 4 - Multiple Local File Inclusions
CVE-2008-3564—webappsphp
Multiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute
23RIESGO
abrir ↗
Referência
CVE-2023-54399
CVE-2023-54399CRITICAL
Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree
48RIESGO
abrir ↗
Referência
CVE-2026-16557
CVE-2026-16557MEDIUM
Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins
33RIESGO
abrir ↗
← anteriorpágina 543 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.