Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2025-15546
CVE-2025-15546MEDIUM
Iptanus File Upload < 5.1.7 - File Overwrite via Race Condition
33RIESGO
abrir ↗
Referência
CVE-2026-10292
CVE-2026-10292HIGH
UTT HiPER 1200GW formTaskEdit strcpy stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-25557
CVE-2026-25557MEDIUM
Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter
33RIESGO
abrir ↗
Referência
CVE-2026-10290
CVE-2026-10290MEDIUM
code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10289
CVE-2026-10289MEDIUM
code-projects Hotel and Tourism Reservation System tour.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2014-125138
CVE-2014-125138HIGH
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
41RIESGO
abrir ↗
Referência
CVE-2014-125138
CVE-2014-125138HIGH
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
41RIESGO
abrir ↗
Referência
CVE-2014-125138
CVE-2014-125138HIGH
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
41RIESGO
abrir ↗
Referência
CVE-2026-10217
CVE-2026-10217MEDIUM
nextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management
33RIESGO
abrir ↗
Referência
CVE-2026-10216
CVE-2026-10216MEDIUM
unitedbyai droidclaw claim Endpoint pairing.ts excessive authentication
33RIESGO
abrir ↗
Referência
CVE-2026-10215
CVE-2026-10215MEDIUM
Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-10214
CVE-2026-10214MEDIUM
zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-10213
CVE-2026-10213MEDIUM
AstrBotDevs AstrBot API Endpoint delete path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-10203
CVE-2026-10203MEDIUM
OFCMS JSON Query SystemParamController.java query sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10192
CVE-2026-10192HIGH
Tenda W12 httpd set_local_time_0 stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-10294
CVE-2026-10294MEDIUM
PackageKit API pk-transaction.c g_file_test improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-10250
CVE-2026-10250MEDIUM
itsourcecode Online Blood Bank Management System campsdetails.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10287
CVE-2026-10287MEDIUM
SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-10219
CVE-2026-10219MEDIUM
nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-10218
CVE-2026-10218MEDIUM
nextlevelbuilder GoClaw evolution_handlers.go auth improper authorization
33RIESGO
abrir ↗
Referência
CVE-2018-19571
CVE-2018-19571—
GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an
35RIESGO
abrir ↗
Referência✓ VexDay Proof
more.groupware 0.74 - 'new_calendarid' SQL Injection
CVE-2006-4906—webappsphp
SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component Highwood Design hwdVideoShare - SQL Injection
CVE-2008-0916—webappsphp
SQL injection vulnerability in the Highwood Design hwdVideoShare (com_hwdvideoshare) 1.1.3 Alpha component for Joomla!
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CafeEngine - Multiple SQL Injections
CVE-2008-4605—webappsphp
SQL injection vulnerability in CafeEngine allows remote attackers to execute arbitrary SQL commands via the id parameter
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Ultimate WebBoard 3.00 - 'Category' SQL Injection
CVE-2008-4666—webappsphp
SQL injection vulnerability in webboard.php in Ultimate Webboard 3.00 allows remote attackers to execute arbitrary SQL c
23RIESGO
abrir ↗
Referência
CVE-2026-10258
CVE-2026-10258MEDIUM
itsourcecode Content Management System add_sub_topic.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10253
CVE-2026-10253MEDIUM
itsourcecode Online House Rental System manage_payment.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10251
CVE-2026-10251MEDIUM
itsourcecode Online House Rental System ajax.php login sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-116118
CVE-2026-116118MEDIUM
Z.ai Zcode Sed Command Filter os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-10111
CVE-2026-10111MEDIUM
sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection
33RIESGO
abrir ↗
← anteriorpágina 576 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.