Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-86406
CVE-2026-86406HIGH
User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase
41RIESGO
abrir ↗
Referência
CVE-2026-116044
CVE-2026-116044MEDIUM
prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-116007
CVE-2026-116007MEDIUM
YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication
33RIESGO
abrir ↗
Referência
CVE-2026-104681
CVE-2026-104681LOW
Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field
28RIESGO
abrir ↗
Referência
CVE-2026-104680
CVE-2026-104680HIGH
Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard
41RIESGO
abrir ↗
Referência
CVE-2018-6084
CVE-2018-6084—
Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local
23RIESGO
abrir ↗
Referência
CVE-2026-103695
CVE-2026-103695HIGH
Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-108539
CVE-2026-108539MEDIUM
GPAC MP4Box filter_queue.c gf_fq_pop use after free
33RIESGO
abrir ↗
Referência
CVE-2026-108538
CVE-2026-108538MEDIUM
GPAC MP4Box os_thread.c gf_mx_v use after free
33RIESGO
abrir ↗
Referência
CVE-2026-108523
CVE-2026-108523MEDIUM
Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-16252
CVE-2026-16252MEDIUM
Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection
33RIESGO
abrir ↗
Referência
CVE-2021-48016
CVE-2021-48016CRITICAL
DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
48RIESGO
abrir ↗
Referência
CVE-2018-25439
CVE-2018-25439HIGH
MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter
41RIESGO
abrir ↗
Referência
CVE-2018-25438
CVE-2018-25438HIGH
Intermesh Group-Office < 3.5.5 Path Traversal via compress.php
41RIESGO
abrir ↗
Referência
CVE-2017-20288
CVE-2017-20288MEDIUM
QCubed 3.1.1 Reflected XSS via installer step_2.php
33RIESGO
abrir ↗
Referência
CVE-2026-14561
CVE-2026-14561MEDIUM
Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-14927
CVE-2026-14927LOW
FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes
28RIESGO
abrir ↗
Referência
CVE-2026-14922
CVE-2026-14922MEDIUM
WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment
33RIESGO
abrir ↗
Referência
CVE-2026-15511
CVE-2026-15511CRITICAL
Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-16073
CVE-2026-16073MEDIUM
AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-62239
CVE-2026-62239MEDIUM
FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
33RIESGO
abrir ↗
Referência
CVE-2014-3120
CVE-2014-3120HIGHbajo ataque
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
100RIESGO
abrir ↗
Referência
CVE-2026-14800
CVE-2026-14800MEDIUM
imhamzaazam ecommerceFlask cross-site request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-6382
CVE-2026-6382CRITICAL
Multiple elFinder Plugins - Authenticated OS Command Injection
48RIESGO
abrir ↗
Referência
CVE-2026-15473
CVE-2026-15473MEDIUM
Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-14723
CVE-2026-14723MEDIUM
AD-Security AD_Miner Cache analyse_cache.py request_a deserialization
33RIESGO
abrir ↗
Referência
CVE-2026-15472
CVE-2026-15472MEDIUM
Eleveo Call Recording Software composeEmailAction.do improper authorization
33RIESGO
abrir ↗
Referência
CVE-2018-7602
CVE-2018-7602HIGHbajo ataqueransomware
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
100RIESGO
abrir ↗
Referência
CVE-2026-15515
CVE-2026-15515HIGH
Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path
41RIESGO
abrir ↗
Referência
CVE-2014-3792
CVE-2014-3792—
Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote at
23RIESGO
abrir ↗
← anteriorpágina 588 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.