Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2018-9155
CVE-2018-9155—
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary we
23RIESGO
abrir ↗
Referência
CVE-2018-9206
CVE-2018-9206—
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RIESGO
abrir ↗
Referência✓ VexDay Proof
Wsn (Multiple Products) - Local File Inclusion / Code Execution
CVE-2008-3555—webappsphp
Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3)
23RIESGO
abrir ↗
Referência
CVE-2026-18037
CVE-2026-18037MEDIUM
Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
33RIESGO
abrir ↗
Referência
CVE-2011-1099
CVE-2011-1099—
Multiple directory traversal vulnerabilities in FocalMedia.Net Quick Polls before 1.0.2 allow remote attackers to (1) re
23RIESGO
abrir ↗
Referência
CVE-2013-3538
CVE-2013-3538—
Multiple cross-site scripting (XSS) vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to injec
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Mihalism Multi Forum Host 3.0.x - Remote File Inclusion
CVE-2007-6657—webappsphp
PHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier
23RIESGO
abrir ↗
Referência
CVE-2026-85703
CVE-2026-85703MEDIUM
ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resources
33RIESGO
abrir ↗
Referência
CVE-2026-16589
CVE-2026-16589HIGH
WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-16293
CVE-2026-16293MEDIUM
Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL
33RIESGO
abrir ↗
Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.8.6i - '.tta' File Parsing Heap Overflow (PoC)
CVE-2008-3732—dosmultiple
Integer overflow in the Open function in modules/demux/tta.c in VLC Media Player 0.8.6i allows remote attackers to cause
28RIESGO
abrir ↗
Referência
Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE
CVE-2025-1097HIGHremotemultiple
ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation
68RIESGO
abrir ↗
Referência
CVE-2026-8256
CVE-2026-8256MEDIUM
Devs Palace ERP Online mr-save cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-85702
CVE-2026-85702MEDIUM
ramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-8255
CVE-2026-8255MEDIUM
Devs Palace ERP Online add_new_customer cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-8251
CVE-2026-8251MEDIUM
Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-12773
CVE-2026-12773MEDIUM
BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Active PHP BookMarks 1.1.02 - SQL Injection
CVE-2008-3748—webappsphp
SQL injection vulnerability in view_group.php in Active PHP Bookmarks (APB) 1.1.02 and 1.2.06 allows remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2026-80116
CVE-2026-80116HIGH
PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL
41RIESGO
abrir ↗
Referência
CVE-2026-85637
CVE-2026-85637MEDIUM
jofpin trape Admin Endpoint sockets.py join_room missing authentication
33RIESGO
abrir ↗
Referência
CVE-2013-0928
CVE-2013-0928—
The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote
50RIESGO
abrir ↗
Referência✓ VexDay Proof
Web Directory Script 1.5.3 - 'site' SQL Injection
CVE-2008-4091—webappsphp
SQL injection vulnerability in index.php in Web Directory Script 1.5.3 allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Autodealers CMS AutOnline - 'id' SQL Injection
CVE-2008-4074—webappsphp
SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2015-1482
CVE-2015-1482—
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive inform
23RIESGO
abrir ↗
Referência
CVE-2019-0708
CVE-2019-0708CRITICALbajo ataqueransomware
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RIESGO
abrir ↗
Referência
CVE-2026-19077
CVE-2026-19077MEDIUM
Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization
33RIESGO
abrir ↗
Referência
CVE-2026-7160
CVE-2026-7160HIGH
Tenda HG3 formTracert command injection
41RIESGO
abrir ↗
Referência
CVE-2026-7159
CVE-2026-7159MEDIUM
douinc mkdocs-mcp-plugin server.py list_documents path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7158
CVE-2026-7158MEDIUM
dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-7157
CVE-2026-7157MEDIUM
disler aider-mcp-server aider_ai_code server.py command injection
33RIESGO
abrir ↗
← anteriorpágina 804 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.