Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.899exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.463 exploits
Referência
CVE-2026-34109
CVE-2026-34109CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php
48RIESGO
abrir ↗
Referência
CVE-2018-15884
CVE-2018-15884—
RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-14761
CVE-2026-14761MEDIUM
radareorg radare2 str.c r_str_append integer overflow
33RIESGO
abrir ↗
Referência
CVE-2014-5112
CVE-2014-5112—
maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacha
23RIESGO
abrir ↗
Referência
CVE-2018-16133
CVE-2018-16133—
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
50RIESGO
abrir ↗
Referência
CVE-2026-13562
CVE-2026-13562HIGH
Edimax EW-7478APC POST Request formiNICSiteSurvey buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2018-25328
CVE-2018-25328HIGH
VX Search 10.6.18 Local Buffer Overflow via Directory Field
41RIESGO
abrir ↗
Referência
CVE-2014-3220
CVE-2014-3220—
F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary u
28RIESGO
abrir ↗
Referência
CVE-2026-13548
CVE-2026-13548MEDIUM
itsourcecode Hospital Management System doctortimings.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2014-3434
CVE-2014-3434—
Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b,
23RIESGO
abrir ↗
Referência
CVE-2010-2676
CVE-2010-2676—
Multiple directory traversal vulnerabilities in index.php in Open Web Analytics (OWA) 1.2.3 might allow remote attackers
23RIESGO
abrir ↗
Referência
CVE-2026-11482
CVE-2026-11482MEDIUM
SourceCodester Class and Exam Timetabling System archive5.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-58051
CVE-2026-58051HIGH
libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
41RIESGO
abrir ↗
Referência
CVE-2026-11481
CVE-2026-11481LOW
yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hash
28RIESGO
abrir ↗
Referência
CVE-2026-13491
CVE-2026-13491MEDIUM
78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Apple Mac OSX 10.5.0 (Leopard) - vpnd Remote Denial of Service (PoC)
CVE-2007-6276—dososx
The accept_connections function in the virtual private network daemon (vpnd) in Apple Mac OS X 10.5 before 10.5.4 allows
23RIESGO
abrir ↗
Referência
CVE-2021-47968
CVE-2021-47968MEDIUM
Podcast Generator 3.1 Persistent Cross-Site Scripting via long_description
33RIESGO
abrir ↗
Referência
CVE-2021-47967
CVE-2021-47967MEDIUM
PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters
33RIESGO
abrir ↗
Referência
CVE-2021-47966
CVE-2021-47966HIGH
PHP Timeclock 1.04 SQL Injection via login.php
41RIESGO
abrir ↗
Referência
CVE-2016-7288
CVE-2016-7288—
The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
45RIESGO
abrir ↗
Referência✓ VexDay Proof
OpenSiteAdmin 0.9.1.1 - Multiple File Inclusions
CVE-2008-0648—webappsphp
Multiple PHP remote file inclusion vulnerabilities in OpenSiteAdmin 0.9.1.1 and earlier allow remote attackers to execut
23RIESGO
abrir ↗
Referência
CVE-2026-77988
CVE-2026-77988MEDIUM
TRENDnet TEW-823DRU CLI Configuration Tool nvram_get command injection
33RIESGO
abrir ↗
Referência
CVE-2014-5345
CVE-2014-5345—
Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress al
23RIESGO
abrir ↗
Referência
CVE-2016-6283
CVE-2016-6283—
Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitra
23RIESGO
abrir ↗
Referência
CVE-2026-56769
CVE-2026-56769MEDIUM
Huly Platform - Server-Side Request Forgery via /import Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-15622
CVE-2026-15622MEDIUM
poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization
33RIESGO
abrir ↗
Referência
CVE-2010-3024
CVE-2010-3024—
Multiple cross-site request forgery (CSRF) vulnerabilities in user/main/update_user in DiamondList 0.1.6, and possibly e
23RIESGO
abrir ↗
Referência
CVE-2026-11964
CVE-2026-11964CRITICAL
User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation
48RIESGO
abrir ↗
Referência
CVE-2010-5299
CVE-2010-5299—
Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl f
50RIESGO
abrir ↗
Referência
CVE-2011-4572
CVE-2011-4572—
Cross-site scripting (XSS) vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82, 1.4.1, and probably
23RIESGO
abrir ↗
← anteriorpágina 760 / 883siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.