Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-92099
CVE-2026-92099MEDIUM
WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting
33RIESGO
abrir ↗
Referência
CVE-2026-91847
CVE-2026-91847MEDIUM
Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-88926
CVE-2026-88926HIGH
VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi
41RIESGO
abrir ↗
Referência
CVE-2026-88824
CVE-2026-88824HIGH
Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings
41RIESGO
abrir ↗
Referência
CVE-2026-93740
CVE-2026-93740CRITICAL
Totolink A3002MU formWlEncrypt buffer overflow
48RIESGO
abrir ↗
Referência
CVE-2019-25776
CVE-2019-25776HIGH
Weaver E-cology SQL Injection via SyncUserInfo.jsp
41RIESGO
abrir ↗
Referência★ 36
Proof of concept exploit for CVE-2026-106173, a path traversal file write leading to RCE for Fortinet FortiSIEM
CVE-2026-106173CRITICAL
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5
48RIESGO
abrir ↗
Referência
CVE-2026-96880
CVE-2026-96880MEDIUM
TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-96810
CVE-2026-96810MEDIUM
huanzi-qch base-admin Add User CommonController.java save cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-96803
CVE-2026-96803MEDIUM
java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-88997
CVE-2026-88997MEDIUM
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
33RIESGO
abrir ↗
Referência
CVE-2026-19364
CVE-2026-19364MEDIUM
itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-19361
CVE-2026-19361MEDIUM
macrozheng mall mall-portal getAuthCode password recovery
33RIESGO
abrir ↗
Referência
CVE-2026-87981
CVE-2026-87981MEDIUM
Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions
33RIESGO
abrir ↗
Referência
CVE-2026-91016
CVE-2026-91016MEDIUM
Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-91015
CVE-2026-91015MEDIUM
Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired
33RIESGO
abrir ↗
Referência
CVE-2026-88904
CVE-2026-88904HIGH
PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation
41RIESGO
abrir ↗
Referência
CVE-2026-87786
CVE-2026-87786HIGH
Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates
41RIESGO
abrir ↗
Referência
CVE-2026-17459
CVE-2026-17459MEDIUM
perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink
33RIESGO
abrir ↗
Referência
CVE-2026-17458
CVE-2026-17458MEDIUM
mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-19352
CVE-2026-19352LOW
mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery
28RIESGO
abrir ↗
Referência
CVE-2026-19351
CVE-2026-19351MEDIUM
dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-96604
CVE-2026-96604MEDIUM
SoftNews Media Group DataLife Engine Search search.php strip_data sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-87979
CVE-2026-87979MEDIUM
Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook
33RIESGO
abrir ↗
Referência
CVE-2026-87074
CVE-2026-87074LOW
Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link
28RIESGO
abrir ↗
Referência
CVE-2026-108783
CVE-2026-108783MEDIUM
PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials
33RIESGO
abrir ↗
Referência
CVE-2026-84168
CVE-2026-84168MEDIUM
Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-84856
CVE-2026-84856MEDIUM
rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-8151
CVE-2026-8151MEDIUM
Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
33RIESGO
abrir ↗
Referência
CVE-2026-85409
CVE-2026-85409MEDIUM
Eleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversal
33RIESGO
abrir ↗
← anteriorpágina 589 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.