Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-16986
CVE-2026-16986MEDIUM
Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters
33RIESGO
abrir ↗
Referência
CVE-2026-90524
CVE-2026-90524MEDIUM
jaychouchannel Tourism-Management-System Update Endpoint missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-13406
CVE-2026-13406MEDIUM
Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-114392
CVE-2026-114392MEDIUM
Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
33RIESGO
abrir ↗
Referência
CVE-2026-103301
CVE-2026-103301MEDIUM
Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
33RIESGO
abrir ↗
Referência
CVE-2026-82483
CVE-2026-82483MEDIUM
coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-81026
CVE-2026-81026MEDIUM
MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN
33RIESGO
abrir ↗
Referência
CVE-2026-13415
CVE-2026-13415HIGH
CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings
41RIESGO
abrir ↗
Referência
CVE-2026-87837
CVE-2026-87837MEDIUM
Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook
33RIESGO
abrir ↗
Referência
CVE-2026-81812
CVE-2026-81812MEDIUM
Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
33RIESGO
abrir ↗
Referência
CVE-2026-66731
CVE-2026-66731HIGH
facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
41RIESGO
abrir ↗
Referência
CVE-2026-77004
CVE-2026-77004MEDIUM
Comfast CF-N1-S mbox-config sprintf command injection
33RIESGO
abrir ↗
Referência
CVE-2024-6244
CVE-2024-6244HIGH
pz-frontend-manager < 1.0.6 - CSRF change user profile picture
41RIESGO
abrir ↗
Referência
CVE-2021-43481
CVE-2021-43481—
An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstag
23RIESGO
abrir ↗
Referência
CVE-2026-66730
CVE-2026-66730HIGH
facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser
41RIESGO
abrir ↗
Referência
CVE-2026-66729
CVE-2026-66729HIGH
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
41RIESGO
abrir ↗
Referência
CVE-2021-43701
CVE-2021-43701—
CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/articl
23RIESGO
abrir ↗
Referência
CVE-2026-113356
CVE-2026-113356HIGH
DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
41RIESGO
abrir ↗
Referência
CVE-2026-83544
CVE-2026-83544MEDIUM
Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute
33RIESGO
abrir ↗
Referência
CVE-2026-84887
CVE-2026-84887MEDIUM
simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-109440
CVE-2026-109440HIGH
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
41RIESGO
abrir ↗
Referência
CVE-2026-82667
CVE-2026-82667MEDIUM
yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2019-1253
CVE-2019-1253HIGHbajo ataqueransomware
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To e
76RIESGO
abrir ↗
Referência
CVE-2020-10963
CVE-2020-10963—
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution)
28RIESGO
abrir ↗
Referência
CVE-2026-112101
CVE-2026-112101MEDIUM
BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
33RIESGO
abrir ↗
Referência
CVE-2026-13174
CVE-2026-13174HIGH
Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR
41RIESGO
abrir ↗
Referência
CVE-2018-18776
CVE-2018-18776—
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (
23RIESGO
abrir ↗
Referência
CVE-2018-18776
CVE-2018-18776—
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (
23RIESGO
abrir ↗
Referência
CVE-2018-18777
CVE-2018-18777—
Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subp
43RIESGO
abrir ↗
Referência✓ VexDay Proof
blogme 3.0 - Cross-Site Scripting / Authentication Bypass
CVE-2006-5975—webappsasp
Multiple cross-site scripting (XSS) vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbit
23RIESGO
abrir ↗
← anteriorpágina 592 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.