Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-108901
CVE-2026-108901MEDIUM
Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer
33RIESGO
abrir ↗
Referência
CVE-2026-108897
CVE-2026-108897MEDIUM
Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine
33RIESGO
abrir ↗
Referência
CVE-2026-108895
CVE-2026-108895CRITICAL
Linksys E1700 setDMZ os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-89297
CVE-2026-89297HIGH
Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-14847
CVE-2026-14847MEDIUM
Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-108885
CVE-2026-108885MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete
33RIESGO
abrir ↗
Referência
CVE-2026-108884
CVE-2026-108884MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-14240
CVE-2026-14240MEDIUM
Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export
33RIESGO
abrir ↗
Referência
CVE-2026-16602
CVE-2026-16602HIGH
Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint
41RIESGO
abrir ↗
Referência
CVE-2026-16561
CVE-2026-16561HIGH
Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure
41RIESGO
abrir ↗
Referência
CVE-2026-94044
CVE-2026-94044MEDIUM
03-lovepreetSingh MCP route.ts create_file path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-16572
CVE-2026-16572HIGH
LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie
41RIESGO
abrir ↗
Referência
CVE-2026-16565
CVE-2026-16565MEDIUM
Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API
33RIESGO
abrir ↗
Referência
CVE-2026-16564
CVE-2026-16564MEDIUM
Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-94015
CVE-2026-94015MEDIUM
SourceCodester Drug Recommendation System edit_user.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14554
CVE-2026-14554MEDIUM
Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters
48RIESGO
abrir ↗
Referência
CVE-2024-58387
CVE-2024-58387HIGH
Inspur HCM Cloud Arbitrary File Read via file/download Endpoint
41RIESGO
abrir ↗
Referência
CVE-2013-20008
CVE-2013-20008HIGH
Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
41RIESGO
abrir ↗
Referência
CVE-2026-87777
CVE-2026-87777MEDIUM
Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute
33RIESGO
abrir ↗
Referência
CVE-2017-8678
CVE-2017-8678—
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
23RIESGO
abrir ↗
Referência
CVE-2026-96680
CVE-2026-96680MEDIUM
ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization
33RIESGO
abrir ↗
Referência
CVE-2026-96676
CVE-2026-96676MEDIUM
Fast FAC1900R uhttpd get_alias_name stack-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-100192
CVE-2026-100192MEDIUM
X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-16542
CVE-2026-16542MEDIUM
Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar
33RIESGO
abrir ↗
Referência
CVE-2026-117526
CVE-2026-117526MEDIUM
reduxjs redux-devtools Remotedev Server evalAction code injection
33RIESGO
abrir ↗
Referência
CVE-2026-102846
CVE-2026-102846MEDIUM
gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-117516
CVE-2026-117516MEDIUM
oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2017-8680
CVE-2017-8680—
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
23RIESGO
abrir ↗
Referência
CVE-2026-93964
CVE-2026-93964MEDIUM
NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-19751
CVE-2026-19751MEDIUM
EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery
33RIESGO
abrir ↗
← anteriorpágina 595 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.