Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-15385
CVE-2026-15385MEDIUM
RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS
33RIESGO
abrir ↗
Referência
CVE-2026-103090
CVE-2026-103090HIGH
Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
41RIESGO
abrir ↗
Referência
CVE-2026-86183
CVE-2026-86183MEDIUM
diem-project diem dmWidget BasedmWidgetActions.class.php authorization
33RIESGO
abrir ↗
Referência
CVE-2026-81737
CVE-2026-81737HIGH
FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information
41RIESGO
abrir ↗
Referência
CVE-2026-19345
CVE-2026-19345MEDIUM
code-projects Task Management System UpdateTaskStatus.php authorization
33RIESGO
abrir ↗
Referência
CVE-2026-87069
CVE-2026-87069LOW
Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
28RIESGO
abrir ↗
Referência
CVE-2026-94096
CVE-2026-94096CRITICAL
Netcore NBR200V2 LAN IP Configuration network_tools command injection
48RIESGO
abrir ↗
Referência
CVE-2026-77884
CVE-2026-77884HIGH
Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure
41RIESGO
abrir ↗
Referência
CVE-2026-82596
CVE-2026-82596MEDIUM
LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption
33RIESGO
abrir ↗
Referência
CVE-2026-18722
CVE-2026-18722MEDIUM
diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization
33RIESGO
abrir ↗
Referência
CVE-2026-16057
CVE-2026-16057MEDIUM
Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
33RIESGO
abrir ↗
Referência
CVE-2026-19862
CVE-2026-19862MEDIUM
JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
33RIESGO
abrir ↗
Referência
CVE-2026-86209
CVE-2026-86209MEDIUM
SourceCodester Class and Exam Timetabling System delete_user.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-112152
CVE-2026-112152MEDIUM
vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-112086
CVE-2026-112086MEDIUM
ESPnet Inference Model inference_model.py build_model deserialization
33RIESGO
abrir ↗
Referência
CVE-2026-106933
CVE-2026-106933MEDIUM
Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
33RIESGO
abrir ↗
Referência
CVE-2026-106028
CVE-2026-106028MEDIUM
ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation
33RIESGO
abrir ↗
Referência
CVE-2026-111874
CVE-2026-111874MEDIUM
OpenCATS Career Portal CareersUI.php processLogin excessive authentication
33RIESGO
abrir ↗
Referência
CVE-2022-40022
CVE-2022-40022CRITICAL
Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
85RIESGO
abrir ↗
Referência
CVE-2021-40870
CVE-2021-40870CRITICALbajo ataque
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Core Image Fun House 2.0 (OSX) - Arbitrary Code Execution (PoC)
CVE-2008-2304—dososx
Buffer overflow in Apple Core Image Fun House 2.0 and earlier in CoreImage Examples in Xcode tools before 3.1 allows use
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component beamospetition 1.0.12 - SQL Injection / Cross-Site Scripting
CVE-2009-0378—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in the beamospetition (com_beamospetition) 1.0.12 component for Jo
23RIESGO
abrir ↗
Referência
CVE-2010-3206
CVE-2010-3206—
Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code v
23RIESGO
abrir ↗
Referência
CVE-2018-11138
CVE-2018-11138CRITICALbajo ataqueransomware
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
100RIESGO
abrir ↗
Referência
CVE-2019-8943
CVE-2019-8943—
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can
60RIESGO
abrir ↗
Referência
CVE-2023-31069
CVE-2023-31069—
An issue was discovered in TSplus Remote Access through 16.0.2.14. Credentials are stored as cleartext within the HTML s
23RIESGO
abrir ↗
Referência✓ VexDay Proof
XOOPS Module resmanager 1.21 - Blind SQL Injection
CVE-2007-2735—webappsphp
SQL injection vulnerability in edit_day.php in the ResManager 1.2.1 and earlier module for Xoops allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2017-12629
CVE-2017-12629—
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction wi
60RIESGO
abrir ↗
Referência✓ VexDay Proof
IBM Domino Web Access 7.0 Upload Module - 'inotes6.dll' Remote Buffer Overflow
CVE-2007-4474—remotewindows
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, in
50RIESGO
abrir ↗
Referência
ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution (Metasploit)
CVE-2019-11448—remotewindows
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain th
28RIESGO
abrir ↗
← anteriorpágina 562 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.