Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência✓ VexDay Proof
idautomation bar code - ActiveX Multiple Vulnerabilities
CVE-2008-2283—remotewindows
IDAutomation allows remote attackers to overwrite arbitrary files via the argument to the (1) SaveBarCode and (2) SaveEn
23RIESGO
abrir ↗
Referência
CVE-2026-15234
CVE-2026-15234MEDIUM
Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute
33RIESGO
abrir ↗
Referência
Microsoft Windows Server 2025 Hyper-V NT Kernel Integration VSP - Elevation of Privilege
CVE-2025-21333HIGHbajo ataquelocalwindows
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
76RIESGO
abrir ↗
Referência
CVE-2026-15262
CVE-2026-15262MEDIUM
Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column
33RIESGO
abrir ↗
Referência
CVE-2026-118438
CVE-2026-118438MEDIUM
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
33RIESGO
abrir ↗
Referência
CVE-2026-100907
CVE-2026-100907MEDIUM
Eyeplus p2pcam Service snapshot information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-118437
CVE-2026-118437LOW
BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
28RIESGO
abrir ↗
Referência
CVE-2026-12696
CVE-2026-12696MEDIUM
wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field
33RIESGO
abrir ↗
Referência
CVE-2026-108609
CVE-2026-108609MEDIUM
JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-120597
CVE-2026-120597MEDIUM
Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-79713
CVE-2026-79713MEDIUM
Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component SimpleShop 3.4 - SQL Injection
CVE-2008-2568—webappsphp
SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) component 3.4 and earlier for Joomla! allows remo
23RIESGO
abrir ↗
Referência✓ VexDay Proof
freeSSHd 1.2.1 - (Authenticated) Remote Stack Overflow (PoC)
CVE-2008-2573—doswindows
Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a
23RIESGO
abrir ↗
Referência
CVE-2018-12465
CVE-2018-12465CRITICAL
Remote Code Execution in Micro Focus Secure Messaging Gateway
85RIESGO
abrir ↗
Referência✓ VexDay Proof
Roundcube Webmail 0.2b - Remote Code Execution
CVE-2008-5619—webappsphp
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail)
35RIESGO
abrir ↗
Referência
CVE-2018-20485
CVE-2018-20485—
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpMyAdmin 3.1.0 - Cross-Site Request Forgery / SQL Injection
CVE-2008-5621—webappsphp
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remot
23RIESGO
abrir ↗
Referência
CVE-2026-120503
CVE-2026-120503MEDIUM
EchoHS GeekezBrowser Public API status information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-29508
CVE-2026-29508HIGH
ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser
41RIESGO
abrir ↗
Referência
CVE-2018-13108
CVE-2018-13108—
All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerabilit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WordPress Plugin Page Flip Image Gallery 0.2.2 - Remote File Disclosure
CVE-2008-5752—webappsphp
Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress
23RIESGO
abrir ↗
Referência
CVE-2008-5753
CVE-2008-5753—
Stack-based buffer overflow in BulletProof FTP Client 2.63 and 2010 allows user-assisted attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2021-24276
CVE-2021-24276—
Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)
43RIESGO
abrir ↗
Referência
CVE-2026-119731
CVE-2026-119731HIGH
Munshi Payment Bypass via Unauthenticated Webhook Endpoint
41RIESGO
abrir ↗
Referência
CVE-2026-120448
CVE-2026-120448HIGH
DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint
41RIESGO
abrir ↗
Referência
CVE-2021-24272
CVE-2021-24272—
Fitness Calculators < 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS)
23RIESGO
abrir ↗
Referência✓ VexDay Proof
eFiction 3.0 - 'toplists.php' SQL Injection
CVE-2008-2754—webappsphp
SQL injection vulnerability in toplists.php in eFiction 3.0 and 3.4.3, when magic_quotes_gpc is disabled, allows remote
23RIESGO
abrir ↗
Referência
CVE-2026-107323
CVE-2026-107323MEDIUM
Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS
33RIESGO
abrir ↗
Referência
CVE-2026-107321
CVE-2026-107321MEDIUM
W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import
33RIESGO
abrir ↗
Referência
CVE-2026-120447
CVE-2026-120447CRITICAL
HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code
48RIESGO
abrir ↗
← anteriorpágina 556 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.