Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.899exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.463 exploits
Referência
CVE-2016-4204
CVE-2016-4204—
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
28RIESGO
abrir ↗
Referência
CVE-2026-7238
CVE-2026-7238MEDIUM
code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-7237
CVE-2026-7237MEDIUM
AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7235
CVE-2026-7235MEDIUM
ErlichLiu claude-agent-sdk-master route.ts path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7234
CVE-2026-7234MEDIUM
BrowserOperator browser-operator-core server.js startsWith path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7233
CVE-2026-7233MEDIUM
Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds
33RIESGO
abrir ↗
Referência
CVE-2013-5977
CVE-2013-5977—
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordP
23RIESGO
abrir ↗
Referência
CVE-2016-4206
CVE-2016-4206—
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
28RIESGO
abrir ↗
Referência
CVE-2026-7217
CVE-2026-7217MEDIUM
Deepractice PromptX Document File index.ts read_pdf absolute path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7221
CVE-2026-7221MEDIUM
TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-7220
CVE-2026-7220MEDIUM
jackwrichards FastlyMCP fastly_cli Tool fastly-mcp.mjs os command injection
33RIESGO
abrir ↗
Referência
CVE-2010-3765
CVE-2010-3765CRITICALbajo ataque
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, a
100RIESGO
abrir ↗
Referência
CVE-2020-37226
CVE-2020-37226HIGH
Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby
41RIESGO
abrir ↗
Referência
CVE-2026-66006
CVE-2026-66006MEDIUM
lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
33RIESGO
abrir ↗
Referência
CVE-2010-5000
CVE-2010-5000—
SQL injection vulnerability in login/login_index.php in MCLogin System 1.1 and 1.2 allows remote attackers to execute ar
23RIESGO
abrir ↗
Referência
CVE-2016-4312
CVE-2016-4312—
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH
23RIESGO
abrir ↗
Referência
CVE-2021-3394
CVE-2021-3394—
Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder per
23RIESGO
abrir ↗
Referência
CVE-2026-14819
CVE-2026-14819LOW
Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move
28RIESGO
abrir ↗
Referência
CVE-2012-0282
CVE-2012-0282—
Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash
23RIESGO
abrir ↗
Referência✓ VexDay Proof
vcart 3.3.2 - Multiple Remote File Inclusions
CVE-2008-0287—webappsphp
PHP remote file inclusion vulnerability in VisionBurst vcart 3.3.2 allows remote attackers to execute arbitrary PHP code
23RIESGO
abrir ↗
Referência
CVE-2026-66005
CVE-2026-66005MEDIUM
Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding
33RIESGO
abrir ↗
Referência
CVE-2026-14827
CVE-2026-14827MEDIUM
Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter
33RIESGO
abrir ↗
Referência✓ VexDay Proof
ImageAlbum 2.0.0b2 - 'id' SQL Injection
CVE-2008-0288—webappsphp
Multiple SQL injection vulnerabilities in ImageAlbum 2.0.0b2 allow remote attackers to execute arbitrary SQL commands vi
23RIESGO
abrir ↗
Referência
CVE-2026-65697
CVE-2026-65697MEDIUM
Fathom Lite 1.3.1 Stored XSS via /collect Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-65696
CVE-2026-65696MEDIUM
Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API
33RIESGO
abrir ↗
Referência
CVE-2026-16194
CVE-2026-16194MEDIUM
zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-16156
CVE-2026-16156MEDIUM
SourceCodester Class and Exam Timetabling System forexam.php cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
RichStrong CMS - 'cat' SQL Injection
CVE-2008-0291—webappsasp
SQL injection vulnerability in showproduct.asp in RichStrong CMS allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2026-65693
CVE-2026-65693HIGH
Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
41RIESGO
abrir ↗
Referência
CVE-2026-66027
CVE-2026-66027HIGH
Suna < 0.9.102 Broken Access Control via Message Queue API
41RIESGO
abrir ↗
← anteriorpágina 763 / 883siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.