Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2025-15705
CVE-2025-15705LOW
Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS
28RIESGO
abrir ↗
Referência
CVE-2026-116010
CVE-2026-116010MEDIUM
RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers
33RIESGO
abrir ↗
Referência
CVE-2026-107887
CVE-2026-107887MEDIUM
Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme
33RIESGO
abrir ↗
Referência
CVE-2026-108688
CVE-2026-108688MEDIUM
Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload
33RIESGO
abrir ↗
Referência
CVE-2026-108663
CVE-2026-108663MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply
33RIESGO
abrir ↗
Referência
CVE-2026-108654
CVE-2026-108654MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById
33RIESGO
abrir ↗
Referência
CVE-2026-102241
CVE-2026-102241MEDIUM
Netcore NAP930 Backup/Restore backup_common.sh hard-coded key
33RIESGO
abrir ↗
Referência
CVE-2026-102363
CVE-2026-102363MEDIUM
mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number
33RIESGO
abrir ↗
Referência
CVE-2026-100313
CVE-2026-100313MEDIUM
mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-100312
CVE-2026-100312MEDIUM
mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-84095
CVE-2026-84095HIGH
WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import
41RIESGO
abrir ↗
Referência
CVE-2026-89237
CVE-2026-89237MEDIUM
Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters
33RIESGO
abrir ↗
Referência
CVE-2026-95833
CVE-2026-95833MEDIUM
itsourcecode Leave Management System index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-94097
CVE-2026-94097CRITICAL
Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
48RIESGO
abrir ↗
Referência
CVE-2026-93973
CVE-2026-93973MEDIUM
SourceCodester Online Reviewer Management System btn_functions.php remove sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-73698
CVE-2026-73698HIGH
FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action
41RIESGO
abrir ↗
Referência
CVE-2026-73694
CVE-2026-73694HIGH
FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition
41RIESGO
abrir ↗
Referência
CVE-2026-110661
CVE-2026-110661MEDIUM
CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header
33RIESGO
abrir ↗
Referência
CVE-2026-109188
CVE-2026-109188MEDIUM
jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
33RIESGO
abrir ↗
Referência
CVE-2026-108886
CVE-2026-108886MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername
33RIESGO
abrir ↗
Referência
CVE-2026-88930
CVE-2026-88930HIGH
Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret
41RIESGO
abrir ↗
Referência
CVE-2026-84251
CVE-2026-84251CRITICAL
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update
48RIESGO
abrir ↗
Referência
CVE-2026-14857
CVE-2026-14857MEDIUM
WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-13612
CVE-2026-13612MEDIUM
KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-18779
CVE-2026-18779MEDIUM
TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked
33RIESGO
abrir ↗
Referência
CVE-2026-13177
CVE-2026-13177MEDIUM
Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR
33RIESGO
abrir ↗
Referência
CVE-2015-20130
CVE-2015-20130MEDIUM
Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php
33RIESGO
abrir ↗
Referência
CVE-2015-20130
CVE-2015-20130MEDIUM
Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php
33RIESGO
abrir ↗
Referência
CVE-2026-118165
CVE-2026-118165MEDIUM
Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute
33RIESGO
abrir ↗
Referência
CVE-2026-118101
CVE-2026-118101MEDIUM
BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification
33RIESGO
abrir ↗
← anteriorpágina 571 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.