Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2022-24637
CVE-2022-24637—
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh
60RIESGO
abrir ↗
Referência
CVE-2022-24637
CVE-2022-24637—
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh
60RIESGO
abrir ↗
Referência
CVE-2004-2502
CVE-2004-2502—
im-switch before 11.4-46.1 in Fedora Core 2 allows local users to overwrite arbitrary files via a symlink attack on the
23RIESGO
abrir ↗
Referência
CVE-2026-15939
CVE-2026-15939LOW
Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API
28RIESGO
abrir ↗
Referência✓ VexDay Proof
PhotoKorn Gallery 1.52 - 'dir_path' Remote File Inclusion
CVE-2006-4670—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execu
28RIESGO
abrir ↗
Referência
CVE-2026-17433
CVE-2026-17433MEDIUM
nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization
33RIESGO
abrir ↗
Referência
CVE-2017-17597
CVE-2017-17597—
Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-17032
CVE-2026-17032CRITICAL
Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server
48RIESGO
abrir ↗
Referência
CVE-2026-16948
CVE-2026-16948HIGH
Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure
41RIESGO
abrir ↗
Referência
CVE-2026-16267
CVE-2026-16267HIGH
Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
41RIESGO
abrir ↗
Referência
CVE-2026-14222
CVE-2026-14222LOW
Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization
28RIESGO
abrir ↗
Referência✓ VexDay Proof
XOOPS Module Core - 'viewcat.php' SQL Injection
CVE-2007-1814—webappsphp
SQL injection vulnerability in viewcat.php in the Core module for Xoops allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2026-13342
CVE-2026-13342MEDIUM
Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password
33RIESGO
abrir ↗
Referência
CVE-2026-19243
CVE-2026-19243MEDIUM
HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-14820
CVE-2026-14820MEDIUM
Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login
33RIESGO
abrir ↗
Referência
Sentrifugo 3.2 - File Upload Restriction Bypass
CVE-2019-15813—webappsphp
Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arb
35RIESGO
abrir ↗
Referência
CVE-2019-16113
CVE-2019-16113—
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j
60RIESGO
abrir ↗
Referência
SpeechBrain < 1.1.1 checkpoint metadata RCE via unsafe PyYAML parsing of CKPT.yaml.
CVE-2026-10036HIGH
SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
41RIESGO
abrir ↗
Referência✓ VexDay Proof
XChat 2.6.7 (Windows) - Remote Denial of Service
CVE-2006-4455—doswindows
Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via un
23RIESGO
abrir ↗
Referência
CVE-2021-39316
CVE-2021-39316HIGH
ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure
68RIESGO
abrir ↗
Referência
CVE-2018-9059
CVE-2018-9059—
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code
60RIESGO
abrir ↗
Referência
CVE-2026-26899
CVE-2026-26899HIGH
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr
41RIESGO
abrir ↗
Referência
Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure
CVE-2021-39327MEDIUMwebappsphp
BulletProof Security <= 5.1 Sensitive Information Disclosure
70RIESGO
abrir ↗
Referência
CVE-2021-4034
CVE-2021-4034HIGHbajo ataqueransomware
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RIESGO
abrir ↗
Referência
CVE-2021-4034
CVE-2021-4034HIGHbajo ataqueransomware
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RIESGO
abrir ↗
Referência
CVE-2022-3141
CVE-2022-3141—
Translatepress Multilinugal < 2.3.3 - Admin+ SQLi
23RIESGO
abrir ↗
Referência
CVE-2022-31470
CVE-2022-31470—
An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12
50RIESGO
abrir ↗
Referência
CVE-2026-75986
CVE-2026-75986MEDIUM
code-projects Online Job Portal System Password Recovery ForPass.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-16127
CVE-2026-16127MEDIUM
zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-16492
CVE-2026-16492MEDIUM
umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection
33RIESGO
abrir ↗
← anteriorpágina 544 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.