Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados

40.553CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.327 exploits

Referência

CVE-2026-87974

CVE-2026-87974MEDIUM

Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook

33RIESGO

abrir ↗

Referência

CVE-2026-107158

CVE-2026-107158MEDIUM

LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route

33RIESGO

abrir ↗

Referência

CVE-2026-18038

CVE-2026-18038MEDIUM

nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-14870

CVE-2026-14870HIGH

Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id

56RIESGO

abrir ↗

Referência

CVE-2026-14545

CVE-2026-14545CRITICAL

TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset

48RIESGO

abrir ↗

Referência

CVE-2026-97315

CVE-2026-97315MEDIUM

Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email

33RIESGO

abrir ↗

Referência

CVE-2026-88998

CVE-2026-88998MEDIUM

Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN

33RIESGO

abrir ↗

Referência

CVE-2026-107126

CVE-2026-107126HIGH

WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header

41RIESGO

abrir ↗

Referência

CVE-2026-116515

CVE-2026-116515MEDIUM

itsourcecode Online Book Store book.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2020-3161

CVE-2020-3161CRITICALbajo ataque

Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability

100RIESGO

abrir ↗

Referência

CVE-2020-3187

CVE-2020-3187CRITICAL

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability

85RIESGO

abrir ↗

Referência

CVE-2026-15038

CVE-2026-15038CRITICAL

InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

48RIESGO

abrir ↗

Referência

Zhiyuan OA - arbitrary file upload leading

CVE-2025-34040CRITICALwebappsmultiple

Seeyon Zhiyuan OA System Path Traversal File Upload

68RIESGO

abrir ↗

Referência

CVE-2026-116514

CVE-2026-116514MEDIUM

itsourcecode Airline Reservation System book_flight.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-108972

CVE-2026-108972MEDIUM

SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication

33RIESGO

abrir ↗

Referência

CVE-2018-19913

CVE-2018-19913—

DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.

23RIESGO

abrir ↗

Referência

CVE-2026-9378

CVE-2026-9378MEDIUM

Edimax BR-6675nD POST Request formHwSet command injection

33RIESGO

abrir ↗

Referência

CVE-2026-108964

CVE-2026-108964MEDIUM

SourceCodester Performance Indicator System addproduct.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-116508

CVE-2026-116508CRITICAL

TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow

48RIESGO

abrir ↗

Referência

CVE-2013-5578

CVE-2013-5578—

Buffer overflow in the ToDot method in the WINGRAPHVIZLib.NEATO ActiveX control in WinGraphviz.dll in StarUML allows rem

23RIESGO

abrir ↗

Referência

CVE-2026-40522

CVE-2026-40522HIGH

FrontAccounting < 2.4.20 SQL Injection via rep601.php

41RIESGO

abrir ↗

Referência

CVE-2026-13510

CVE-2026-13510MEDIUM

SimStudioAI sim Password Protection deployment.ts weak hash

33RIESGO

abrir ↗

Referência

CVE-2026-13509

CVE-2026-13509MEDIUM

RAGapp Knowledge File files.py FileHandler.remove_file path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-13508

CVE-2026-13508MEDIUM

khoj-ai khoj Conversation Sharing api_chat.py authorization

33RIESGO

abrir ↗

Referência

CVE-2026-13504

CVE-2026-13504MEDIUM

code-projects Project Management System Mail Compose mail.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-13496

CVE-2026-13496MEDIUM

itsourcecode Hospital Management System ajaxmedicine.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-13581

CVE-2026-13581MEDIUM

Edimax EW-7478APC POST Request formStaDrvSetup os command injection

33RIESGO

abrir ↗

Referência

CVE-2026-92811

CVE-2026-92811HIGH

browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass

41RIESGO

abrir ↗

Referência

CVE-2013-5672

CVE-2013-5672—

Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow re

23RIESGO

abrir ↗

Referência

CVE-2026-116260

CVE-2026-116260MEDIUM

libimobiledevice AFC Service afc.c service_receive double free

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.