Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-14817
CVE-2026-14817MEDIUM
Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP Blue Dragon CMS 2.9 - Remote File Inclusion
CVE-2006-2392—webappsphp
PHP remote file inclusion vulnerability in public_includes/pub_popup/popup_finduser.php in PHP Blue Dragon Platinum 2.8.
23RIESGO
abrir ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PEGames - 'index.php' Remote File Inclusion
CVE-2006-6213—webappsphp
index.php in PEGames uses the extract function to overwrite critical variables, which allows remote attackers to conduct
23RIESGO
abrir ↗
Referência
CVE-2017-17630
CVE-2017-17630—
Yoga Class Script 1.0 has SQL Injection via the /list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17632
CVE-2017-17632—
Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17632
CVE-2017-17632—
Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-15480
CVE-2026-15480HIGH
Trendnet TEW-635BRM Web Service rc start_httpd stack-based overflow
41RIESGO
abrir ↗
Referência✓ VexDay Proof
torrentflux 2.2 - Arbitrary File Create/ Execute/Delete
CVE-2006-6328—webappsphp
Directory traversal vulnerability in index.php for TorrentFlux 2.2 allows remote attackers to create or overwrite arbitr
23RIESGO
abrir ↗
Referência
CVE-2019-3010
CVE-2019-3010HIGHbajo ataque
Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is a
91RIESGO
abrir ↗
Referência
CVE-2017-17633
CVE-2017-17633—
Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php
23RIESGO
abrir ↗
Referência
CVE-2026-2441
CVE-2026-2441HIGHbajo ataque
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside
83RIESGO
abrir ↗
Referência
CVE-2017-17634
CVE-2017-17634—
Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17637
CVE-2017-17637—
Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.
23RIESGO
abrir ↗
Referência
CVE-2018-4404
CVE-2018-4404HIGH
In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improve
61RIESGO
abrir ↗
Referência
CVE-2017-7938
CVE-2017-7938MEDIUM
Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cau
33RIESGO
abrir ↗
Referência
CVE-2019-5418
CVE-2019-5418HIGHbajo ataque
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe
100RIESGO
abrir ↗
Referência
CVE-2026-105314
CVE-2026-105314HIGH
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call
41RIESGO
abrir ↗
Referência
CVE-2026-116111
CVE-2026-116111MEDIUM
2K Games Civilization V Lua Sandbox loadstring type confusion
33RIESGO
abrir ↗
Referência
CVE-2026-11495
CVE-2026-11495MEDIUM
CodeAstro Ingredients Stock Management System add_stock.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-11494
CVE-2026-11494MEDIUM
TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation
33RIESGO
abrir ↗
Referência✓ VexDay Proof
phpBB2 Plus 1.53 - Acronym Mod SQL Injection
CVE-2006-6842—webappsphp
SQL injection vulnerability in admin/admin_acronyms.php in the Acronym Mod 0.9.5 for phpBB2 Plus 1.53 allows remote atta
23RIESGO
abrir ↗
Referência
CVE-2026-116110
CVE-2026-116110MEDIUM
GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-105247
CVE-2026-105247MEDIUM
SourceCodester Online Reviewer Management System btn_functions.php course sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
wywo inout board 1.0 - Multiple Vulnerabilities
CVE-2006-6846—webappsasp
Multiple SQL injection vulnerabilities in While You Were Out (WYWO) InOut Board 1.0 allow remote attackers to execute ar
23RIESGO
abrir ↗
Referência
CVE-2017-2373
CVE-2017-2373—
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS
23RIESGO
abrir ↗
Referência
CVE-2017-2442
CVE-2017-2442—
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issu
23RIESGO
abrir ↗
Referência
CVE-2026-100881
CVE-2026-100881LOW
zhistaredu StarTraining application.yml cross site scripting
28RIESGO
abrir ↗
Referência
CVE-2026-114741
CVE-2026-114741LOW
WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
28RIESGO
abrir ↗
Referência
MarcomCentral FusionPro VDP Creator < 10.0 - Directory Traversal
CVE-2019-7751—webappswindows
A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, for
28RIESGO
abrir ↗
← anteriorpágina 547 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.