Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-92397
CVE-2026-92397CRITICAL
Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-16953
CVE-2026-16953MEDIUM
AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie
33RIESGO
abrir ↗
Referência
CVE-2017-2460
CVE-2017-2460—
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RIESGO
abrir ↗
Referência
Booked Scheduler 2.7.5 - Remote Command Execution (Metasploit)
CVE-2019-9581—webappsphp
phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitra
28RIESGO
abrir ↗
Referência
CVE-2026-108686
CVE-2026-108686LOW
WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
28RIESGO
abrir ↗
Referência
CVE-2021-31674
CVE-2021-31674—
Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacke
23RIESGO
abrir ↗
Referência
CVE-2026-108685
CVE-2026-108685LOW
WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
28RIESGO
abrir ↗
Referência
CVE-2026-11531
CVE-2026-11531MEDIUM
imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-18468
CVE-2026-18468HIGH
Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header
41RIESGO
abrir ↗
Referência
CVE-2014-9148
CVE-2014-9148—
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update"
28RIESGO
abrir ↗
Referência
CVE-2014-9178
CVE-2014-9178—
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plu
23RIESGO
abrir ↗
Referência
qdPM 9.2 - Cross-site Request Forgery (CSRF)
CVE-2022-26180—webappsphp
qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
23RIESGO
abrir ↗
Referência
CVE-2022-27308
CVE-2022-27308—
A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrar
23RIESGO
abrir ↗
Referência
CVE-2026-19346
CVE-2026-19346HIGH
Tenda CH22 CertListInfo formCertListInfo command injection
41RIESGO
abrir ↗
Referência
CVE-2026-17011
CVE-2026-17011LOW
Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection
28RIESGO
abrir ↗
Referência
CVE-2026-105258
CVE-2026-105258LOW
LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
28RIESGO
abrir ↗
Referência
CVE-2026-103693
CVE-2026-103693CRITICAL
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
48RIESGO
abrir ↗
Referência
CVE-2019-25745
CVE-2019-25745HIGH
WordPress Plugin Google Review Slider 6.1 SQL Injection via tid
41RIESGO
abrir ↗
Referência
CVE-2019-25735
CVE-2019-25735HIGH
AllPlayer 7.4 Local Buffer Overflow via SEH Unicode
41RIESGO
abrir ↗
Referência
CVE-2026-10809
CVE-2026-10809MEDIUM
itsourcecode Fees Management System manage_user.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10803
CVE-2026-10803LOW
MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash
28RIESGO
abrir ↗
Referência
CVE-2026-110509
CVE-2026-110509MEDIUM
Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler
33RIESGO
abrir ↗
Referência
CVE-2015-1730
CVE-2015-1730—
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor
28RIESGO
abrir ↗
Referência
CVE-2017-12635
CVE-2017-12635—
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be
60RIESGO
abrir ↗
Referência
CVE-2026-10691
CVE-2026-10691MEDIUM
wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos
33RIESGO
abrir ↗
Referência
CVE-2026-10688
CVE-2026-10688MEDIUM
ahujasid blender-mcp server.py execute_blender_code code injection
33RIESGO
abrir ↗
Referência
CVE-2026-10650
CVE-2026-10650MEDIUM
warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption
33RIESGO
abrir ↗
Referência
CVE-2026-10650
CVE-2026-10650MEDIUM
warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption
33RIESGO
abrir ↗
Referência
CVE-2026-10624
CVE-2026-10624MEDIUM
SourceCodester Human Resource Management Employee View detailview.php resource injection
33RIESGO
abrir ↗
Referência
CVE-2026-110507
CVE-2026-110507LOW
Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments
28RIESGO
abrir ↗
← anteriorpágina 552 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.