Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência✓ VexDay Proof
PHP iCalendar 2.21 - 'publish.ical.php' Remote Code Execution
CVE-2006-1291—webappsphp
publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write acce
23RIESGO
abrir ↗
Referência
CVE-2026-70667
CVE-2026-70667MEDIUM
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
33RIESGO
abrir ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALbajo ataque
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RIESGO
abrir ↗
Referência
CVE-2017-17605
CVE-2017-17605—
Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17609
CVE-2017-17609—
Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-15215
CVE-2026-15215HIGH
Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation
41RIESGO
abrir ↗
Referência
CVE-2026-19049
CVE-2026-19049HIGH
ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie
41RIESGO
abrir ↗
Referência
CVE-2020-14882
CVE-2020-14882CRITICALbajo ataque
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Arab Portal 2.1 (Windows) - Remote File Disclosure
CVE-2008-5787—webappsphp
Directory traversal vulnerability in mod.php in Arab Portal 2.1 on Windows allows remote attackers to read arbitrary fil
23RIESGO
abrir ↗
Referência
CVE-2020-14882
CVE-2020-14882CRITICALbajo ataque
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RIESGO
abrir ↗
Referência
CVE-2026-16595
CVE-2026-16595MEDIUM
WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-15214
CVE-2026-15214MEDIUM
Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Light Weight Calendar 1.x - 'date' Remote Code Execution
CVE-2006-1252—webappsphp
Eval injection vulnerability in cal.php in Light Weight Calendar (LWC) 1.0 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2026-15032
CVE-2026-15032MEDIUM
wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPAlumni - SQL Injection
CVE-2008-5815—webappsphp
SQL injection vulnerability in Acomment.php in phpAlumni allows remote attackers to execute arbitrary SQL commands via t
23RIESGO
abrir ↗
Referência
CVE-2022-50964
CVE-2022-50964MEDIUM
uBidAuction 2.0.1 myAuctions loose Reflected XSS
33RIESGO
abrir ↗
Referência
CVE-2022-50964
CVE-2022-50964MEDIUM
uBidAuction 2.0.1 myAuctions loose Reflected XSS
33RIESGO
abrir ↗
Referência
CVE-2022-50963
CVE-2022-50963MEDIUM
uBidAuction 2.0.1 myAuctions active Reflected XSS
33RIESGO
abrir ↗
Referência
CVE-2022-50963
CVE-2022-50963MEDIUM
uBidAuction 2.0.1 myAuctions active Reflected XSS
33RIESGO
abrir ↗
Referência
CVE-2022-50960
CVE-2022-50960MEDIUM
WordPress International Sms Contact Form 7 Integration 1.2 XSS
33RIESGO
abrir ↗
Referência
CVE-2022-50959
CVE-2022-50959MEDIUM
WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php
33RIESGO
abrir ↗
Referência
CVE-2022-50958
CVE-2022-50958MEDIUM
WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php
33RIESGO
abrir ↗
Referência
CVE-2022-50957
CVE-2022-50957MEDIUM
Drupal avatar_uploader 7.x-1.0-beta8 Reflected XSS
33RIESGO
abrir ↗
Referência
CVE-2022-50956
CVE-2022-50956MEDIUM
WordPress Plugin amministrazione-aperta 3.7.3 Local File Read
33RIESGO
abrir ↗
Referência
CVE-2022-50955
CVE-2022-50955MEDIUM
WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery
33RIESGO
abrir ↗
Referência
CVE-2022-50954
CVE-2022-50954MEDIUM
WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion
33RIESGO
abrir ↗
Referência
CVE-2022-50949
CVE-2022-50949MEDIUM
WordPress Plugin Videos sync PDF 1.7.4 Stored XSS
33RIESGO
abrir ↗
Referência
CVE-2022-50948
CVE-2022-50948MEDIUM
Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting
33RIESGO
abrir ↗
Referência
CVE-2022-50947
CVE-2022-50947MEDIUM
WordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSS
33RIESGO
abrir ↗
Referência
CVE-2022-50946
CVE-2022-50946MEDIUM
WordPress Plugin Netroics Blog Posts Grid 1.0 Stored XSS
33RIESGO
abrir ↗
← anteriorpágina 800 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.