Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-3035
CVE-2026-3035MEDIUM
Authentication Bypass Using an Alternate Path or Channel in GitLab
33RIESGO
abrir ↗
Referência
CVE-2019-2215
CVE-2019-2215HIGHbajo ataque
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗
Referência
CVE-2014-6287
CVE-2014-6287CRITICALbajo ataque
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RIESGO
abrir ↗
Referência
CVE-2014-6287
CVE-2014-6287CRITICALbajo ataque
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RIESGO
abrir ↗
Referência
CVE-2017-1129
CVE-2017-1129—
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it coul
50RIESGO
abrir ↗
Referência
CVE-2026-15318
CVE-2026-15318MEDIUM
Sipeed PicoClaw MQTT Channel mqtt.go authorization
33RIESGO
abrir ↗
Referência
CVE-2026-12517
CVE-2026-12517MEDIUM
Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Site Info Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-34099
CVE-2026-34099CRITICAL
Guardian Language-System Unauthenticated SQL Injection via id Parameter in job_info.php
48RIESGO
abrir ↗
Referência
CVE-2026-89050
CVE-2026-89050MEDIUM
Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL
33RIESGO
abrir ↗
Referência
CVE-2017-7043
CVE-2017-7043—
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo
23RIESGO
abrir ↗
Referência
CVE-2026-87759
CVE-2026-87759HIGH
Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation
41RIESGO
abrir ↗
Referência
CVE-2014-7190
CVE-2014-7190—
Multiple cross-site request forgery (CSRF) vulnerabilities in Openfiler 2.99.1 allow remote attackers to hijack the auth
23RIESGO
abrir ↗
Referência
CVE-2026-58376
CVE-2026-58376HIGH
Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints
41RIESGO
abrir ↗
Referência
CVE-2026-58375
CVE-2026-58375HIGH
JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export
41RIESGO
abrir ↗
Referência
CVE-2026-58371
CVE-2026-58371LOW
SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter
28RIESGO
abrir ↗
Referência
CVE-2026-58176
CVE-2026-58176HIGH
RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints
41RIESGO
abrir ↗
Referência
CVE-2017-11548
CVE-2017-11548—
The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of servic
23RIESGO
abrir ↗
Referência
CVE-2026-13571
CVE-2026-13571MEDIUM
SourceCodester Simple Food Ordering System cart.php logic error
33RIESGO
abrir ↗
Referência
CVE-2026-40523
CVE-2026-40523HIGH
FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php
41RIESGO
abrir ↗
Referência
CVE-2026-9676
CVE-2026-9676MEDIUM
f4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification
33RIESGO
abrir ↗
Referência
CVE-2026-10083
CVE-2026-10083HIGH
APCu Manager < 4.5.0 - Unauthenticated Stored XSS via Cache Key Pollution
41RIESGO
abrir ↗
Referência
CVE-2026-13540
CVE-2026-13540MEDIUM
GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2018-0823
CVE-2018-0823—
The Named Pipe File System in Windows 10 version 1709 and Windows Server, version 1709 allows an elevation of privilege
23RIESGO
abrir ↗
Referência
CVE-2019-5736
CVE-2019-5736—
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RIESGO
abrir ↗
Referência
CVE-2019-6275
CVE-2019-6275—
Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attac
28RIESGO
abrir ↗
Referência
CVE-2019-7276
CVE-2019-7276—
Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.
60RIESGO
abrir ↗
Referência
snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (2)
CVE-2019-7304HIGHlocallinux
Local privilege escalation via snapd socket
53RIESGO
abrir ↗
Referência
CVE-2014-8295
CVE-2014-8295—
SQL injection vulnerability in joblogs.php in Bacula-Web 5.2.10 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2017-11911
CVE-2017-11911—
ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code i
35RIESGO
abrir ↗
Referência
CVE-2018-0707
CVE-2018-0707—
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
50RIESGO
abrir ↗
← anteriorpágina 794 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.