Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-75079
CVE-2026-75079MEDIUM
SourceCodester Class and Exam Timetabling System edit_subject2.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2017-8751
CVE-2017-8751—
Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user
35RIESGO
abrir ↗
Referência
CVE-2020-25762
CVE-2020-25762—
An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input v
28RIESGO
abrir ↗
Referência
CVE-2026-76639
CVE-2026-76639HIGH
Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal
41RIESGO
abrir ↗
Referência
CVE-2026-76589
CVE-2026-76589CRITICAL
TRENDnet TEW-755AP mycli FUN_401000 stack-based overflow
48RIESGO
abrir ↗
Referência
CVE-2025-14558
CVE-2025-14558HIGH
Remote code execution via ND6 Router Advertisements
56RIESGO
abrir ↗
Referência
CVE-2026-75077
CVE-2026-75077MEDIUM
SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-18778
CVE-2026-18778MEDIUM
TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions
33RIESGO
abrir ↗
Referência
CVE-2026-19092
CVE-2026-19092CRITICAL
Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
63RIESGO
abrir ↗
Referência
CVE-2015-7047
CVE-2015-7047—
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to g
23RIESGO
abrir ↗
Referência
Genexis Platinum 4410 Router 2.1 - UPnP Credential Exposure
CVE-2020-25988—remotehardware
UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X_GetAccess' wh
23RIESGO
abrir ↗
Referência
CVE-2017-9791
CVE-2017-9791CRITICALbajo ataque
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passe
100RIESGO
abrir ↗
Referência
CVE-2015-7857
CVE-2015-7857—
SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.p
60RIESGO
abrir ↗
Referência
CVE-2026-15149
CVE-2026-15149MEDIUM
WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation
33RIESGO
abrir ↗
Referência
CVE-2026-86445
CVE-2026-86445MEDIUM
LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax
33RIESGO
abrir ↗
Referência
CVE-2026-15230
CVE-2026-15230HIGH
YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure
41RIESGO
abrir ↗
Referência
CVE-2020-3452
CVE-2020-3452HIGHbajo ataque
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability
100RIESGO
abrir ↗
Referência
CVE-2026-15208
CVE-2026-15208MEDIUM
RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification
33RIESGO
abrir ↗
Referência
CVE-2026-18969
CVE-2026-18969MEDIUM
Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-18968
CVE-2026-18968MEDIUM
ttttonyhe OBlog tags.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2017-9805
CVE-2017-9805HIGHbajo ataque
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RIESGO
abrir ↗
Referência
CVE-2025-15677
CVE-2025-15677LOW
GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories
28RIESGO
abrir ↗
Referência
CVE-2026-16548
CVE-2026-16548MEDIUM
Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-18970
CVE-2026-18970MEDIUM
Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-16069
CVE-2026-16069MEDIUM
Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point
33RIESGO
abrir ↗
Referência
CVE-2015-8257
CVE-2015-8257—
The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell
28RIESGO
abrir ↗
Referência
CVE-2026-12973
CVE-2026-12973MEDIUM
PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Hospital Management System 4.0 - 'searchdata' SQL Injection
CVE-2020-5192—webappsphp
PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages an
43RIESGO
abrir ↗
Referência✓ VexDay Proof
Mambo Component mambatStaff 3.1b - Remote File Inclusion
CVE-2006-3947—webappsphp
PHP remote file inclusion vulnerability in components/com_mambatstaff/mambatstaff.php in the Mambatstaff 3.1b and earlie
23RIESGO
abrir ↗
Referência
CVE-2016-0051
CVE-2016-0051—
The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window
43RIESGO
abrir ↗
← anteriorpágina 549 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.