Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados

40.553CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.327 exploits

Referência

CVE-2026-19770

CVE-2026-19770MEDIUM

feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2017-15973

CVE-2017-15973—

Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.

23RIESGO

abrir ↗

Referência

CVE-2026-77148

CVE-2026-77148CRITICAL

Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow

48RIESGO

abrir ↗

Referência

CVE-2026-19699

CVE-2026-19699LOW

GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure

28RIESGO

abrir ↗

Referência

CVE-2017-17589

CVE-2017-17589—

FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parame

23RIESGO

abrir ↗

Referência

CVE-2017-17589

CVE-2017-17589—

FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parame

23RIESGO

abrir ↗

Referência

CVE-2017-17592

CVE-2017-17592—

Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter.

23RIESGO

abrir ↗

Referência✓ VexDay Proof

SQuery 4.5 - 'libpath' Remote File Inclusion

CVE-2006-1610—webappsphp

PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Auton

23RIESGO

abrir ↗

Referência

CVE-2015-2844

CVE-2015-2844—

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arb

28RIESGO

abrir ↗

Referência

CVE-2026-61518

CVE-2026-61518HIGH

ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter

41RIESGO

abrir ↗

Referência

CVE-2015-2845

CVE-2015-2845—

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arb

60RIESGO

abrir ↗

Referência

CVE-2026-72844

CVE-2026-72844MEDIUM

Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections

33RIESGO

abrir ↗

Referência

CVE-2026-77022

CVE-2026-77022CRITICAL

Comfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow

48RIESGO

abrir ↗

Referência

CVE-2026-19697

CVE-2026-19697MEDIUM

GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload

33RIESGO

abrir ↗

Referência

CVE-2015-2845

CVE-2015-2845—

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arb

60RIESGO

abrir ↗

Referência

CVE-2015-2878

CVE-2015-2878—

Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac

23RIESGO

abrir ↗

Referência

CVE-2017-17622

CVE-2017-17622—

Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.

23RIESGO

abrir ↗

Referência

CVE-2017-17625

CVE-2017-17625—

Professional Service Script 1.0 has SQL Injection via the service-list city parameter.

23RIESGO

abrir ↗

Referência

CVE-2013-5316

CVE-2013-5316—

Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of

23RIESGO

abrir ↗

Referência

CVE-2015-5116

CVE-2015-5116—

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481

28RIESGO

abrir ↗

Referência

CVE-2015-5065

CVE-2015-5065—

Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic

28RIESGO

abrir ↗

Referência

CVE-2020-15922

CVE-2020-15922—

There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE)

35RIESGO

abrir ↗

Referência

Opmon 9.11 - Cross-site Scripting

CVE-2021-43009—remotemultiple

A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the reque

23RIESGO

abrir ↗

Referência

CVE-2022-50964

CVE-2022-50964MEDIUM

uBidAuction 2.0.1 myAuctions loose Reflected XSS

33RIESGO

abrir ↗

Referência

CVE-2022-50964

CVE-2022-50964MEDIUM

uBidAuction 2.0.1 myAuctions loose Reflected XSS

33RIESGO

abrir ↗

Referência

CVE-2022-50963

CVE-2022-50963MEDIUM

uBidAuction 2.0.1 myAuctions active Reflected XSS

33RIESGO

abrir ↗

Referência

CVE-2022-50963

CVE-2022-50963MEDIUM

uBidAuction 2.0.1 myAuctions active Reflected XSS

33RIESGO

abrir ↗

Referência

CVE-2022-50960

CVE-2022-50960MEDIUM

WordPress International Sms Contact Form 7 Integration 1.2 XSS

33RIESGO

abrir ↗

Referência

CVE-2022-50959

CVE-2022-50959MEDIUM

WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php

33RIESGO

abrir ↗

Referência

CVE-2022-50958

CVE-2022-50958MEDIUM

WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.