Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2021-44228
CVE-2021-44228CRITICALbajo ataqueransomware
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗
Referência
CVE-2015-8556
CVE-2015-8556—
Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
28RIESGO
abrir ↗
Referência
CVE-2021-44228
CVE-2021-44228CRITICALbajo ataqueransomware
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗
Referência
CVE-2021-44228
CVE-2021-44228CRITICALbajo ataqueransomware
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗
Referência
CVE-2026-108112
CVE-2026-108112MEDIUM
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint
33RIESGO
abrir ↗
Referência
CVE-2021-44228
CVE-2021-44228CRITICALbajo ataqueransomware
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RIESGO
abrir ↗
Referência
CVE-2026-108111
CVE-2026-108111MEDIUM
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Stats 0.1.9.1b - 'ip' SQL Injection
CVE-2006-7172—webappsphp
Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers
23RIESGO
abrir ↗
Referência
CVE-2026-18853
CVE-2026-18853MEDIUM
ZomboDroid Meme Generator App com.zombodroid.MemeGenerator t5.l.c path traversal
33RIESGO
abrir ↗
Referência
CVE-2016-3672
CVE-2016-3672—
The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize t
23RIESGO
abrir ↗
Referência
CVE-2017-17635
CVE-2017-17635—
MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eve
23RIESGO
abrir ↗
Referência
CVE-2026-75012
CVE-2026-75012HIGH
TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference
41RIESGO
abrir ↗
Referência
CVE-2026-75011
CVE-2026-75011MEDIUM
kylecui NetForensicMCP index.js execAsync command injection
33RIESGO
abrir ↗
Referência
CVE-2026-74899
CVE-2026-74899CRITICAL
openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy
48RIESGO
abrir ↗
Referência
CVE-2019-12372
CVE-2019-12372—
Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.
23RIESGO
abrir ↗
Referência
CVE-2017-17636
CVE-2017-17636—
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.
23RIESGO
abrir ↗
Referência
CVE-2015-7858
CVE-2015-7858—
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un
60RIESGO
abrir ↗
Referência
CVE-2013-7025
CVE-2013-7025—
Multiple cross-site scripting (XSS) vulnerabilities in ematStaticAlertTypes.jsp in the Alert Settings section in Dell So
23RIESGO
abrir ↗
Referência
CVE-2016-2385
CVE-2016-2385—
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER a
28RIESGO
abrir ↗
Referência
CVE-2015-7889
CVE-2015-7889—
The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions f
23RIESGO
abrir ↗
Referência
CVE-2026-20000
CVE-2026-20000MEDIUM
itsourcecode Hospital Management System viewprescriptionrecord.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2017-17649
CVE-2017-17649—
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.
23RIESGO
abrir ↗
Referência
CentOS Control Web Panel 0.9.8.836 - Authentication Bypass
CVE-2019-13605—webappslinux
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in
28RIESGO
abrir ↗
Referência
CVE-2026-19966
CVE-2026-19966MEDIUM
CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization
33RIESGO
abrir ↗
Referência
CVE-2026-63769
CVE-2026-63769MEDIUM
Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method
33RIESGO
abrir ↗
Referência
CVE-2016-3473
CVE-2016-3473—
Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0,
28RIESGO
abrir ↗
Referência
CVE-2019-13720
CVE-2019-13720HIGHbajo ataque
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap
83RIESGO
abrir ↗
Referência
CVE-2026-19968
CVE-2026-19968MEDIUM
Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h ReadFaces_3DGS_MDL7 heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-19967
CVE-2026-19967MEDIUM
Open Asset Import Library Assimp File Compression.cpp decompressBlock heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2016-0492
CVE-2016-0492—
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
60RIESGO
abrir ↗
← anteriorpágina 803 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.