Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection
CVE-2023-34635—webappsphp
Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not vali
23RIESGO
abrir ↗
Referência
CVE-2021-24286
CVE-2021-24286—
Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)
43RIESGO
abrir ↗
Referência✓ VexDay Proof
Kaqoo Auction - 'install_root' Multiple Remote File Inclusions
CVE-2007-1790—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Kaqoo Auction Software Free Edition allow remote attackers to exec
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Picture-Engine 1.2.0 - 'wall.php?cat' SQL Injection
CVE-2007-1791—webappsphp
SQL injection vulnerability in wall.php in Picture-Engine 1.2.0 and earlier allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2014-8826
CVE-2014-8826—
LaunchServices in Apple OS X before 10.10.2 does not properly handle file-type metadata, which allows attackers to bypas
23RIESGO
abrir ↗
Referência
CVE-2014-8904
CVE-2014-8904—
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
23RIESGO
abrir ↗
Referência
CVE-2026-67549
CVE-2026-67549HIGH
OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write
41RIESGO
abrir ↗
Referência
CVE-2026-54460
CVE-2026-54460CRITICAL
OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover
48RIESGO
abrir ↗
Referência
CVE-2014-9178
CVE-2014-9178—
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plu
23RIESGO
abrir ↗
Referência
CVE-2023-37269
CVE-2023-37269LOW
Winter CMS vulnerable to stored XSS through privileged upload of SVG file
28RIESGO
abrir ↗
Referência
CVE-2023-37979
CVE-2023-37979HIGH
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)
56RIESGO
abrir ↗
Referência✓ VexDay Proof
AirMore 1.6.1 - Denial of Service (PoC)
CVE-2019-9831—dosandroid
The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via
28RIESGO
abrir ↗
Referência
CVE-2023-4278
CVE-2023-4278HIGH
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
41RIESGO
abrir ↗
Referência
CVE-2026-94042
CVE-2026-94042MEDIUM
AdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-94041
CVE-2026-94041MEDIUM
AdithyaYelloju Restaurant-Management-System add_menu.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-94040
CVE-2026-94040MEDIUM
vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-94038
CVE-2026-94038MEDIUM
NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2014-9567
CVE-2014-9567—
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RIESGO
abrir ↗
Referência
CVE-2014-9567
CVE-2014-9567—
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RIESGO
abrir ↗
Referência
CVE-2026-94033
CVE-2026-94033MEDIUM
SourceCodester Drug Recommendation System User Management add_user cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2014-9583
CVE-2014-9583—
common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC
60RIESGO
abrir ↗
Referência
CVE-2014-9612
CVE-2014-9612—
SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1
23RIESGO
abrir ↗
Referência
CVE-2026-94032
CVE-2026-94032MEDIUM
itsourcecode Leave Management System index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-85130
CVE-2026-85130HIGH
WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs
41RIESGO
abrir ↗
Referência
CVE-2026-92466
CVE-2026-92466HIGH
microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
41RIESGO
abrir ↗
Referência
CVE-2026-85127
CVE-2026-85127HIGH
VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment
41RIESGO
abrir ↗
Referência
CVE-2026-85009
CVE-2026-85009MEDIUM
RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery
33RIESGO
abrir ↗
Referência
CVE-2026-84829
CVE-2026-84829HIGH
Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-96882
CVE-2026-96882MEDIUM
TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-92221
CVE-2026-92221MEDIUM
gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection
33RIESGO
abrir ↗
← anteriorpágina 591 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.