Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-108521
CVE-2026-108521MEDIUM
Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-108677
CVE-2026-108677HIGH
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName
41RIESGO
abrir ↗
Referência
CVE-2026-108673
CVE-2026-108673MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls
33RIESGO
abrir ↗
Referência
CVE-2026-16619
CVE-2026-16619HIGH
miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts
41RIESGO
abrir ↗
Referência
CVE-2014-2579
CVE-2014-2579—
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers
23RIESGO
abrir ↗
Referência
CVE-2014-2587
CVE-2014-2587—
SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated user
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Barracuda Web Application Firewall - Authentication Bypass
CVE-2014-2595—remotehardware
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a perm
28RIESGO
abrir ↗
Referência
CVE-2014-2598
CVE-2014-2598—
Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows
23RIESGO
abrir ↗
Referência
CVE-2014-2623
CVE-2014-2623—
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
60RIESGO
abrir ↗
Referência
CVE-2026-18995
CVE-2026-18995MEDIUM
netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-108664
CVE-2026-108664MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById
33RIESGO
abrir ↗
Referência
CVE-2026-108655
CVE-2026-108655MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById
33RIESGO
abrir ↗
Referência
CVE-2026-15511
CVE-2026-15511CRITICAL
Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-16073
CVE-2026-16073MEDIUM
AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-62239
CVE-2026-62239MEDIUM
FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
33RIESGO
abrir ↗
Referência
CVE-2014-3120
CVE-2014-3120HIGHbajo ataque
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
100RIESGO
abrir ↗
Referência
CVE-2026-14800
CVE-2026-14800MEDIUM
imhamzaazam ecommerceFlask cross-site request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-6382
CVE-2026-6382CRITICAL
Multiple elFinder Plugins - Authenticated OS Command Injection
48RIESGO
abrir ↗
Referência
CVE-2026-15473
CVE-2026-15473MEDIUM
Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-14723
CVE-2026-14723MEDIUM
AD-Security AD_Miner Cache analyse_cache.py request_a deserialization
33RIESGO
abrir ↗
Referência
CVE-2026-15472
CVE-2026-15472MEDIUM
Eleveo Call Recording Software composeEmailAction.do improper authorization
33RIESGO
abrir ↗
Referência
CVE-2018-7602
CVE-2018-7602HIGHbajo ataqueransomware
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
100RIESGO
abrir ↗
Referência
CVE-2026-15515
CVE-2026-15515HIGH
Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path
41RIESGO
abrir ↗
Referência
CVE-2014-3792
CVE-2014-3792—
Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote at
23RIESGO
abrir ↗
Referência
CVE-2026-87846
CVE-2026-87846MEDIUM
Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion
33RIESGO
abrir ↗
Referência
CVE-2026-107640
CVE-2026-107640CRITICAL
Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API
48RIESGO
abrir ↗
Referência
CVE-2026-85348
CVE-2026-85348MEDIUM
GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF
33RIESGO
abrir ↗
Referência
CVE-2026-94244
CVE-2026-94244MEDIUM
Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export
33RIESGO
abrir ↗
Referência
CVE-2026-94501
CVE-2026-94501HIGH
jshERP through 3.6 Privilege Escalation via userBusiness CRUD
41RIESGO
abrir ↗
Referência
CVE-2014-3977
CVE-2014-3977—
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
23RIESGO
abrir ↗
← anteriorpágina 554 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.