Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-114260
CVE-2026-114260MEDIUM
oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-114259
CVE-2026-114259MEDIUM
oretnom23 file-management-system-php admin_class.php save_files unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-114258
CVE-2026-114258MEDIUM
oretnom23 file-management-system-php File Management files.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-114257
CVE-2026-114257MEDIUM
oretnom23 file-management-system-php File Download download.php readfile sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-81740
CVE-2026-81740MEDIUM
Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback
33RIESGO
abrir ↗
Referência
CVE-2026-104120
CVE-2026-104120MEDIUM
modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-104054
CVE-2026-104054MEDIUM
calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization
33RIESGO
abrir ↗
Referência
CVE-2026-104053
CVE-2026-104053MEDIUM
itsourcecode Pet Shop Management System admin_reservefilter.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-103544
CVE-2026-103544MEDIUM
datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session
33RIESGO
abrir ↗
Referência
CVE-2026-96255
CVE-2026-96255HIGH
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log
41RIESGO
abrir ↗
Referência
CVE-2026-81809
CVE-2026-81809HIGH
Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
41RIESGO
abrir ↗
Referência
CVE-2026-81739
CVE-2026-81739HIGH
Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
41RIESGO
abrir ↗
Referência
CVE-2026-85573
CVE-2026-85573HIGH
All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
41RIESGO
abrir ↗
Referência
CVE-2026-85415
CVE-2026-85415MEDIUM
Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL
33RIESGO
abrir ↗
Referência
CVE-2026-85001
CVE-2026-85001MEDIUM
EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute
33RIESGO
abrir ↗
Referência
CVE-2026-83560
CVE-2026-83560MEDIUM
New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass
33RIESGO
abrir ↗
Referência
CVE-2026-82127
CVE-2026-82127LOW
Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields
28RIESGO
abrir ↗
Referência
CVE-2026-105471
CVE-2026-105471MEDIUM
girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-97332
CVE-2026-97332MEDIUM
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
33RIESGO
abrir ↗
Referência
CVE-2026-93549
CVE-2026-93549HIGH
CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
41RIESGO
abrir ↗
Referência
CVE-2026-80333
CVE-2026-80333MEDIUM
Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes
33RIESGO
abrir ↗
Referência
CVE-2026-105099
CVE-2026-105099MEDIUM
Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-105098
CVE-2026-105098MEDIUM
Omega Solution CoinEx Crypto Support Ticket API customer information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-104052
CVE-2026-104052MEDIUM
itsourcecode Pet Shop Management System admin_reject_completed.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-90706
CVE-2026-90706MEDIUM
D-Link DWR-M921 formWsc os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-90705
CVE-2026-90705MEDIUM
D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-90607
CVE-2026-90607CRITICAL
Totolink A3002MU boa formNewSchedule buffer overflow
48RIESGO
abrir ↗
Referência
CVE-2026-92399
CVE-2026-92399MEDIUM
GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-92364
CVE-2026-92364MEDIUM
itsourcecode Leave Management System index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2025-68624
CVE-2025-68624MEDIUM
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user
33RIESGO
abrir ↗
← anteriorpágina 609 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.