Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2022-0482
CVE-2022-0482CRITICAL
Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
75RIESGO
abrir ↗
Referência
CVE-2026-85121
CVE-2026-85121CRITICAL
Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign
48RIESGO
abrir ↗
Referência✓ VexDay Proof
eXchange POP3 5.0.050203 - RPCT TO Remote Buffer Overflow
CVE-2006-0537—remotewindows
Buffer overflow in the POP3 server in Kinesphere Corporation eXchange before 5.0.060125 allows remote attackers to execu
35RIESGO
abrir ↗
Referência✓ VexDay Proof
jspwiki 2.4.104/2.5.139 - Multiple Vulnerabilities
CVE-2008-1229—webappsjsp
Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject ar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Active Time Billing 3.2 - Authentication Bypass
CVE-2008-5632—webappsphp
SQL injection vulnerability in Account.asp in Active Time Billing 3.2 allows remote attackers to execute arbitrary SQL c
23RIESGO
abrir ↗
Referência
CVE-2026-108668
CVE-2026-108668MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Lito Lite CMS - 'cid' SQL Injection
CVE-2008-5636—webappsphp
SQL injection vulnerability in cate.php in Lito Lite CMS, when magic_quotes_gpc is disabled, allows remote attackers to
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CMS Made Simple 1.4.1 - Local File Inclusion
CVE-2008-5642—webappsphp
Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary
23RIESGO
abrir ↗
Referência
CVE-2026-17514
CVE-2026-17514MEDIUM
ZJONSSON node-unzipper extract.js Extract path traversal
33RIESGO
abrir ↗
Referência
WinWaste.NET 1.0.6183.16475 - Privilege Escalation due Incorrect Access Control
CVE-2021-34110—localwindows
WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executa
23RIESGO
abrir ↗
Referência
CVE-2021-35312
CVE-2021-35312—
A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Serv
23RIESGO
abrir ↗
Referência
CVE-2026-61511
CVE-2026-61511CRITICAL
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
63RIESGO
abrir ↗
Referência
CVE-2021-35323
CVE-2021-35323—
Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.
38RIESGO
abrir ↗
Referência
CVE-2021-48013
CVE-2021-48013HIGH
Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload
41RIESGO
abrir ↗
Referência
CVE-2026-15540
CVE-2026-15540MEDIUM
SourceCodester Online Book Store System Administrative index.php php file inclusion
33RIESGO
abrir ↗
Referência
CVE-2019-0841
CVE-2019-0841HIGHbajo ataqueransomware
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard li
98RIESGO
abrir ↗
Referência
CVE-2026-107079
CVE-2026-107079MEDIUM
An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parame
33RIESGO
abrir ↗
Referência✓ VexDay Proof
vuBB 0.2 Final - 'cookie' SQL Injection
CVE-2006-0962—webappsphp
SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter
23RIESGO
abrir ↗
Referência✓ VexDay Proof
EasyCalendar 4.0tr - Multiple Vulnerabilities
CVE-2008-1345—webappsphp
Cross-site scripting (XSS) vulnerability in plugins/calendar/calendar_backend.php in MyioSoft EasyCalendar 4.0tr and ear
23RIESGO
abrir ↗
Referência
CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) - Cross-Site Scripting
CVE-2019-10893—webappslinux
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to
23RIESGO
abrir ↗
Referência
CVE-2026-86232
CVE-2026-86232MEDIUM
itsourcecode Sales and Inventory System sup_del.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2019-25778
CVE-2019-25778HIGH
SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-16255
CVE-2026-16255MEDIUM
Incorrect Authorization in GitLab
33RIESGO
abrir ↗
Referência
CVE-2026-103515
CVE-2026-103515LOW
Incorrect Authorization in GitLab
28RIESGO
abrir ↗
Referência
CVE-2026-15519
CVE-2026-15519LOW
usestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphere
28RIESGO
abrir ↗
Referência
CVE-2026-11827
CVE-2026-11827MEDIUM
Insufficiently Protected Credentials in GitLab
33RIESGO
abrir ↗
Referência
CVE-2026-15194
CVE-2026-15194MEDIUM
Open5GS AMF context.c amf_context_final use after free
33RIESGO
abrir ↗
Referência
CVE-2026-15036
CVE-2026-15036MEDIUM
Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization
33RIESGO
abrir ↗
Referência
CVE-2019-11354
CVE-2019-11354—
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Ori
28RIESGO
abrir ↗
Referência
CVE-2026-15192
CVE-2026-15192MEDIUM
mettle sendportal APIv1 Webhooks mailjet missing authentication
33RIESGO
abrir ↗
← anteriorpágina 551 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.