Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados

40.553CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.327 exploits

Referência

CVE-2026-78247

CVE-2026-78247MEDIUM

SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-78245

CVE-2026-78245MEDIUM

itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-78244

CVE-2026-78244MEDIUM

itsourcecode Real Estate Management System search.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2015-2524

CVE-2015-2524—

Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not proper

23RIESGO

abrir ↗

Referência

CVE-2026-19053

CVE-2026-19053CRITICAL

ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter

48RIESGO

abrir ↗

Referência

CVE-2016-0492

CVE-2016-0492—

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12

60RIESGO

abrir ↗

Referência

CVE-2017-15975

CVE-2017-15975—

Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability

23RIESGO

abrir ↗

Referência

CVE-2017-17601

CVE-2017-17601—

Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-3220

CVE-2026-3220HIGH

Multiple Plugins - Unauthenticated Stored XSS via Minify Library

41RIESGO

abrir ↗

Referência

CVE-2006-1652

CVE-2006-1652—

Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-ass

50RIESGO

abrir ↗

Referência

CVE-2006-1652

CVE-2006-1652—

Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-ass

50RIESGO

abrir ↗

Referência✓ VexDay Proof

phpunity.postcard - 'gallery_path' Remote File Inclusion

CVE-2006-4869—webappsphp

PHP remote file inclusion vulnerability in phpunity-postcard.php in phpunity.postcard allows remote attackers to execute

23RIESGO

abrir ↗

Referência

CVE-2017-17604

CVE-2017-17604—

Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-108633

CVE-2026-108633MEDIUM

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add

33RIESGO

abrir ↗

Referência

CVE-2017-17613

CVE-2017-17613—

Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php cati

23RIESGO

abrir ↗

Referência

CVE-2026-108624

CVE-2026-108624MEDIUM

JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint

33RIESGO

abrir ↗

Referência

CVE-2014-2023

CVE-2014-2023—

Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allo

23RIESGO

abrir ↗

Referência

CVE-2006-7127

CVE-2006-7127—

Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrar

23RIESGO

abrir ↗

Referência

CVE-2015-3864

CVE-2015-3864—

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A

60RIESGO

abrir ↗

Referência

CVE-2026-8265

CVE-2026-8265MEDIUM

Tenda AC6 httpd getLogFile get_log_file os command injection

33RIESGO

abrir ↗

Referência

CVE-2026-8264

CVE-2026-8264MEDIUM

Tenda AC6 httpd WifiApScan formWifiApScan os command injection

33RIESGO

abrir ↗

Referência

CVE-2026-8263

CVE-2026-8263MEDIUM

Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection

33RIESGO

abrir ↗

Referência

CVE-2026-8262

CVE-2026-8262MEDIUM

Devs Palace ERP Online chart-save cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-8261

CVE-2026-8261MEDIUM

Squirrel sqobject.cpp Load heap-based overflow

33RIESGO

abrir ↗

Referência

CVE-2026-8258

CVE-2026-8258MEDIUM

Squirrel sqstdstring.cpp validate_format stack-based overflow

33RIESGO

abrir ↗

Referência

CVE-2026-8250

CVE-2026-8250MEDIUM

Open5GS SMF n4-build.c smf_n4_build_qos_flow_to_modify_list denial of service

33RIESGO

abrir ↗

Referência

CVE-2026-8249

CVE-2026-8249MEDIUM

Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service

33RIESGO

abrir ↗

Referência

CVE-2021-47930

CVE-2021-47930HIGH

Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated

41RIESGO

abrir ↗

Referência

CVE-2021-47910

CVE-2021-47910MEDIUM

WordPress Plugin AccessPress Social Icons 1.8.2 Stored XSS

33RIESGO

abrir ↗

Referência

CVE-2022-50969

CVE-2022-50969MEDIUM

uBidAuction 2.0.1 mailingLog manage Reflected XSS

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.