Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.275exploits catalogados

40.621CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.377Exploit-DB 24.489GitHub PoC 18.124VulnCheck XDB 10.169Nuclei 4577Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.377 exploits

Referência

CVE-2017-17626

CVE-2017-17626—

Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-88802

CVE-2026-88802HIGH

MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion

41RIESGO

abrir ↗

Referência

CVE-2026-86510

CVE-2026-86510CRITICAL

D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write

48RIESGO

abrir ↗

Referência

CVE-2026-97885

CVE-2026-97885MEDIUM

mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-97062

CVE-2026-97062MEDIUM

Aureus ERP 1.6.0 Stored XSS via SVG File Upload

33RIESGO

abrir ↗

Referência

CVE-2026-94039

CVE-2026-94039MEDIUM

vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-94036

CVE-2026-94036HIGH

D-Link DIR-X1860/DIR-X1860Z routerd ubus access control

41RIESGO

abrir ↗

Referência

CVE-2026-93958

CVE-2026-93958CRITICAL

D-Link R95 DHMAPI ssi system os command injection

48RIESGO

abrir ↗

Referência

CVE-2026-93988

CVE-2026-93988HIGH

QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

41RIESGO

abrir ↗

Referência

CVE-2017-17626

CVE-2017-17626—

Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter.

23RIESGO

abrir ↗

Referência

CVE-2017-17628

CVE-2017-17628—

Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-92459

CVE-2026-92459HIGH

yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint

41RIESGO

abrir ↗

Referência

CVE-2026-86475

CVE-2026-86475MEDIUM

Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission

33RIESGO

abrir ↗

Referência

CVE-2026-91995

CVE-2026-91995CRITICAL

pig before 4.1.0 Unverified Password Change via /register/password

48RIESGO

abrir ↗

Referência

CVE-2026-90521

CVE-2026-90521MEDIUM

jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization

33RIESGO

abrir ↗

Referência

CVE-2026-90515

CVE-2026-90515MEDIUM

SourceCodester School Registration and Fee System delete_stud.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-91779

CVE-2026-91779MEDIUM

GNU Binutils Eh Frame elf-eh-frame.c _bfd_elf_eh_frame_section_offset null pointer dereference

33RIESGO

abrir ↗

Referência

CVE-2026-90505

CVE-2026-90505LOW

vvbbnn00 WARP-Clash-API doUpdateLicenseKey race condition

28RIESGO

abrir ↗

Referência

CVE-2026-86509

CVE-2026-86509CRITICAL

D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow

48RIESGO

abrir ↗

Referência

CVE-2026-90520

CVE-2026-90520MEDIUM

jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-90517

CVE-2026-90517MEDIUM

PHPGurukul Bank Locker Management System view-assign-locker.php authorization

33RIESGO

abrir ↗

Referência

CVE-2026-89009

CVE-2026-89009HIGH

WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server

41RIESGO

abrir ↗

Referência

CVE-2026-86813

CVE-2026-86813MEDIUM

MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To

33RIESGO

abrir ↗

Referência

CVE-2026-90516

CVE-2026-90516MEDIUM

SourceCodester School Registration and Fee System pay_report.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-86809

CVE-2026-86809MEDIUM

Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass

33RIESGO

abrir ↗

Referência

CVE-2026-82213

CVE-2026-82213MEDIUM

Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR

33RIESGO

abrir ↗

Referência

CVE-2017-17637

CVE-2017-17637—

Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-86812

CVE-2026-86812MEDIUM

WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API

33RIESGO

abrir ↗

Referência

CVE-2026-86782

CVE-2026-86782MEDIUM

Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-86789

CVE-2026-86789MEDIUM

Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.