Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados

40.553CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.327 exploits

Referência

PyScript - Read Remote Python Source Code

CVE-2022-30286—remotepython

pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code.

28RIESGO

abrir ↗

Referência

CVE-2026-8935

CVE-2026-8935CRITICAL

Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation

48RIESGO

abrir ↗

Referência

CVE-2026-8386

CVE-2026-8386MEDIUM

WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID

48RIESGO

abrir ↗

Referência

CVE-2026-25856

CVE-2026-25856HIGH

OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface

56RIESGO

abrir ↗

Referência

CVE-2006-3995

CVE-2006-3995—

Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php

28RIESGO

abrir ↗

Referência

CVE-2026-65010

CVE-2026-65010MEDIUM

Datasets Symlink-following Arbitrary File Write via Extractor.extract()

33RIESGO

abrir ↗

Referência

CVE-2026-12981

CVE-2026-12981HIGH

CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset

41RIESGO

abrir ↗

Referência

CVE-2026-63765

CVE-2026-63765HIGH

Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation

41RIESGO

abrir ↗

Referência

CVE-2026-64828

CVE-2026-64828MEDIUM

Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field

33RIESGO

abrir ↗

Referência

CVE-2026-13690

CVE-2026-13690HIGH

UsersWP < 1.2.67 - Two-Factor Authentication Bypass

41RIESGO

abrir ↗

Referência

CVE-2026-12877

CVE-2026-12877CRITICAL

Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter

48RIESGO

abrir ↗

Referência

CVE-2026-13714

CVE-2026-13714CRITICAL

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

48RIESGO

abrir ↗

Referência

CVE-2026-16490

CVE-2026-16490MEDIUM

itsourcecode Hospital Management System prescription.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2022-35919

CVE-2022-35919HIGH

Authenticated requests for server update admin API allows path traversal in minio

53RIESGO

abrir ↗

Referência

CVE-2026-67611

CVE-2026-67611HIGH

OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration

41RIESGO

abrir ↗

Referência

CVE-2018-17254

CVE-2018-17254—

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.

60RIESGO

abrir ↗

Referência

CVE-2026-13390

CVE-2026-13390MEDIUM

The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation

33RIESGO

abrir ↗

Referência

CVE-2026-100887

CVE-2026-100887MEDIUM

amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection

33RIESGO

abrir ↗

Referência✓ VexDay Proof

Mambo Component User Home Pages 0.5 - Remote File Inclusion

CVE-2006-3995—webappsphp

Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php

28RIESGO

abrir ↗

Referência

CVE-2026-12690

CVE-2026-12690LOW

ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization

28RIESGO

abrir ↗

Referência

CVE-2026-13332

CVE-2026-13332CRITICAL

Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)

48RIESGO

abrir ↗

Referência

CVE-2026-13152

CVE-2026-13152HIGH

Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation

41RIESGO

abrir ↗

Referência

CVE-2026-12493

CVE-2026-12493HIGH

Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order

41RIESGO

abrir ↗

Referência

CVE-2020-3452

CVE-2020-3452HIGHbajo ataque

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

100RIESGO

abrir ↗

Referência

CVE-2026-97884

CVE-2026-97884MEDIUM

mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-96777

CVE-2026-96777MEDIUM

Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-84743

CVE-2026-84743LOW

The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes

28RIESGO

abrir ↗

Referência

CVE-2026-92420

CVE-2026-92420LOW

Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR

28RIESGO

abrir ↗

Referência

CVE-2022-50966

CVE-2022-50966MEDIUM

uBidAuction 2.0.1 news manage Reflected XSS

33RIESGO

abrir ↗

Referência✓ VexDay Proof

TinyPHP Forum 3.6 - 'profile.php' Remote Code Execution

CVE-2006-7063—webappsphp

Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.