Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-104118
CVE-2026-104118MEDIUM
Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-17005
CVE-2026-17005MEDIUM
Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field
33RIESGO
abrir ↗
Referência
CVE-2026-105134
CVE-2026-105134CRITICALbajo ataque
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
100RIESGO
abrir ↗
Referência
CVE-2026-105133
CVE-2026-105133MEDIUMbajo ataque
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
100RIESGO
abrir ↗
Referência✓ VexDay Proof
EB Design Pty Ltd - 'EBCRYPT.dll 2.0' Multiple Remote Vulnerabilities
CVE-2007-5110—remotewindows
Absolute path traversal vulnerability in the EbCrypt.eb_c_PRNGenerator.1 ActiveX control in EBCRYPT.DLL 2.0.0.2087 and e
23RIESGO
abrir ↗
Referência✓ VexDay Proof
EB Design Pty Ltd - 'EBCRYPT.dll 2.0' Multiple Remote Vulnerabilities
CVE-2007-5111—remotewindows
A certain ActiveX control in EBCRYPT.DLL 2.0 in EB Design ebCrypt allows remote attackers to cause a denial of service (
23RIESGO
abrir ↗
Referência
CVE-2016-2494
CVE-2016-2494—
Off-by-one error in sdcard/sdcard.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Adult Script 1.6 - Unauthorized Administrative Access
CVE-2007-6414—webappsphp
admin/administrator.php in Adult Script 1.6 and earlier sends a redirect to the web browser but does not exit, which all
23RIESGO
abrir ↗
Referência
CVE-2026-82610
CVE-2026-82610MEDIUM
itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-77786
CVE-2026-77786MEDIUM
Rank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo Ability
33RIESGO
abrir ↗
Referência
CVE-2026-112146
CVE-2026-112146MEDIUM
D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials
33RIESGO
abrir ↗
Referência
CVE-2016-4309
CVE-2016-4309—
Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers
28RIESGO
abrir ↗
Referência
CVE-2026-112281
CVE-2026-112281MEDIUM
libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi
33RIESGO
abrir ↗
Referência
CVE-2026-82801
CVE-2026-82801MEDIUM
NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-82703
CVE-2026-82703MEDIUM
Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-80311
CVE-2026-80311MEDIUM
Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-112276
CVE-2026-112276MEDIUM
Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap
33RIESGO
abrir ↗
Referência
CVE-2026-101148
CVE-2026-101148CRITICAL
BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key
48RIESGO
abrir ↗
Referência
CVE-2026-77704
CVE-2026-77704LOW
Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
28RIESGO
abrir ↗
Referência
CVE-2026-77012
CVE-2026-77012CRITICAL
Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password
48RIESGO
abrir ↗
Referência
CVE-2026-112271
CVE-2026-112271MEDIUM
libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser
33RIESGO
abrir ↗
Referência
CVE-2026-77010
CVE-2026-77010MEDIUM
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Anon Proxy Server 0.1000 - Remote Command Execution
CVE-2007-6459—webappsphp
Anon Proxy Server 0.100, and probably 0.101, allows remote attackers to execute arbitrary commands via shell metacharact
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Form Tools 1.5.0b - Multiple Remote File Inclusions
CVE-2007-6464—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Form tools 1.5.0b allow remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗
Referência
CVE-2026-112145
CVE-2026-112145MEDIUM
speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code
33RIESGO
abrir ↗
Referência
CVE-2026-101147
CVE-2026-101147HIGH
Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF
41RIESGO
abrir ↗
Referência
CVE-2026-103542
CVE-2026-103542MEDIUM
formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-103541
CVE-2026-103541MEDIUM
formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2016-4312
CVE-2016-4312—
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH
23RIESGO
abrir ↗
Referência
CVE-2026-103540
CVE-2026-103540MEDIUM
formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine
33RIESGO
abrir ↗
← anteriorpágina 578 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.