Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-9566
CVE-2026-9566MEDIUM
teableio teable Sign-up LoginPage.tsx cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-10124
CVE-2026-10124HIGH
Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow
41RIESGO
abrir ↗
Referência
OpenSIS 8.0 'modname' - Directory Traversal
CVE-2021-40651—webappsphp
OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), wh
43RIESGO
abrir ↗
Referência
CVE-2026-9631
CVE-2026-9631HIGH
UTT HiPER 1250GW Web Management formConfigFastDirectionW strcpy stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-9628
CVE-2026-9628HIGH
UTT HiPER 1200GW Web Management formPptpClientConfig stack-based overflow
41RIESGO
abrir ↗
Referência✓ VexDay Proof
MVCnPHP 3.0 - glConf[path_libraries] Remote File Inclusion
CVE-2006-4160—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Tony Bibbs and Vincent Furia MVCnPHP 3.0 allow remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2026-43634
CVE-2026-43634HIGH
HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header
41RIESGO
abrir ↗
Referência
CVE-2021-41382
CVE-2021-41382—
Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
23RIESGO
abrir ↗
Referência
CVE-2018-17378
CVE-2018-17378—
SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order p
23RIESGO
abrir ↗
Referência
CVE-2026-23697
CVE-2026-23697HIGH
Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module
41RIESGO
abrir ↗
Referência
CVE-2021-41382
CVE-2021-41382—
Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
23RIESGO
abrir ↗
Referência
CVE-2026-15317
CVE-2026-15317MEDIUM
Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-15182
CVE-2026-15182MEDIUM
GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-8785
CVE-2026-8785MEDIUM
projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-8755
CVE-2026-8755MEDIUM
fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-8754
CVE-2026-8754MEDIUM
AstrBotDevs AstrBot File Upload chat.py post_file path traversal
33RIESGO
abrir ↗
Referência
CVE-2018-25339
CVE-2018-25339HIGH
Zechat 1.5 SQL Injection via v parameter (time-based blind)
41RIESGO
abrir ↗
Referência
CVE-2018-25338
CVE-2018-25338HIGH
Zechat 1.5 SQL Injection via hashtag parameter
41RIESGO
abrir ↗
Referência
CVE-2018-25337
CVE-2018-25337MEDIUM
Joomla JoomOCShop 1.0 Cross-Site Request Forgery
33RIESGO
abrir ↗
Referência
CVE-2021-41773
CVE-2021-41773HIGHbajo ataqueransomware
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗
Referência
CVE-2026-11869
CVE-2026-11869MEDIUM
WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request
33RIESGO
abrir ↗
Referência
CVE-2018-17378
CVE-2018-17378—
SQL Injection exists in the Penny Auction Factory 2.0.4 component for Joomla! via the filter_order_Dir or filter_order p
23RIESGO
abrir ↗
Referência
CVE-2018-17380
CVE-2018-17380—
SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_e
23RIESGO
abrir ↗
Referência
CVE-2018-17380
CVE-2018-17380—
SQL Injection exists in the Article Factory Manager 4.3.9 component for Joomla! via the start_date, m_start_date, or m_e
23RIESGO
abrir ↗
Referência
CVE-2026-89007
CVE-2026-89007LOW
Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
28RIESGO
abrir ↗
Referência
CVE-2026-10248
CVE-2026-10248MEDIUM
SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection
33RIESGO
abrir ↗
Referência
CVE-2026-10616
CVE-2026-10616MEDIUM
nextlevelbuilder GoClaw Team Task Completion team_tasks_lifecycle.go TeamTasksTool.executeComplete authorization
33RIESGO
abrir ↗
Referência
CVE-2021-47983
CVE-2021-47983MEDIUM
WordPress Plugin Stripe Payments < 2.0.40 Stored XSS via currency_code
33RIESGO
abrir ↗
Referência
CVE-2026-10264
CVE-2026-10264MEDIUM
lharries whatsapp-mcp Send API Endpoint main.go SendMessageRequest path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-10256
CVE-2026-10256MEDIUM
itsourcecode Content Management System save_comment.php sql injection
33RIESGO
abrir ↗
← anteriorpágina 569 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.