Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-108963
CVE-2026-108963HIGH
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a data
41RIESGO
abrir ↗
Referência
CVE-2026-108768
CVE-2026-108768MEDIUM
zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources
33RIESGO
abrir ↗
Referência✓ VexDay Proof
AutoDealer 2.0 - 'detail.asp?iPro' SQL Injection
CVE-2007-0053—webappsasp
SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute
23RIESGO
abrir ↗
Referência
CVE-2013-6232
CVE-2013-6232—
Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web
23RIESGO
abrir ↗
Referência
CVE-2013-6236
CVE-2013-6236—
IZON IP 2.0.2: hard-coded password vulnerability
28RIESGO
abrir ↗
Referência
CVE-2026-109175
CVE-2026-109175MEDIUM
MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
33RIESGO
abrir ↗
Referência
CVE-2026-109166
CVE-2026-109166HIGH
lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
41RIESGO
abrir ↗
Referência
CVE-2026-109165
CVE-2026-109165MEDIUM
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create
33RIESGO
abrir ↗
Referência
CVE-2026-108827
CVE-2026-108827LOW
Zen Cart Administrative Module Management general.php zen_call_function code injection
28RIESGO
abrir ↗
Referência
CVE-2026-108878
CVE-2026-108878MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById
33RIESGO
abrir ↗
Referência
CVE-2019-6272
CVE-2019-6272—
Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attacker
28RIESGO
abrir ↗
Referência
CVE-2026-94295
CVE-2026-94295MEDIUM
Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature
33RIESGO
abrir ↗
Referência
CVE-2026-76556
CVE-2026-76556MEDIUM
WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules
33RIESGO
abrir ↗
Referência
CVE-2026-80072
CVE-2026-80072MEDIUM
User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters
33RIESGO
abrir ↗
Referência
CVE-2026-86780
CVE-2026-86780MEDIUM
Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text
33RIESGO
abrir ↗
Referência
CVE-2026-78151
CVE-2026-78151MEDIUM
FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response
33RIESGO
abrir ↗
Referência
CVE-2026-77788
CVE-2026-77788MEDIUM
Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas
33RIESGO
abrir ↗
Referência
CVE-2026-82631
CVE-2026-82631LOW
valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free
28RIESGO
abrir ↗
Referência
CVE-2026-82629
CVE-2026-82629MEDIUM
jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-104682
CVE-2026-104682LOW
Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
28RIESGO
abrir ↗
Referência
CVE-2026-82623
CVE-2026-82623MEDIUM
open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free
33RIESGO
abrir ↗
Referência
CVE-2026-77018
CVE-2026-77018HIGH
Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment
41RIESGO
abrir ↗
Referência
CVE-2026-86406
CVE-2026-86406HIGH
User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase
41RIESGO
abrir ↗
Referência
CVE-2026-116044
CVE-2026-116044MEDIUM
prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-116007
CVE-2026-116007MEDIUM
YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication
33RIESGO
abrir ↗
Referência
CVE-2026-104681
CVE-2026-104681LOW
Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field
28RIESGO
abrir ↗
Referência
CVE-2026-104680
CVE-2026-104680HIGH
Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard
41RIESGO
abrir ↗
Referência
CVE-2018-6084
CVE-2018-6084—
Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local
23RIESGO
abrir ↗
Referência
CVE-2026-103695
CVE-2026-103695HIGH
Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-108539
CVE-2026-108539MEDIUM
GPAC MP4Box filter_queue.c gf_fq_pop use after free
33RIESGO
abrir ↗
← anteriorpágina 550 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.