Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência

CVE-2026-29009

CVE-2026-29009HIGH

U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINK

41RIESGO

abrir ↗

Referência

CVE-2026-111273

CVE-2026-111273MEDIUM

unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name

33RIESGO

abrir ↗

Referência

CVE-2016-0491

CVE-2016-0491—

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12

60RIESGO

abrir ↗

Referência

CVE-2014-2671

CVE-2014-2671—

Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corrupt

35RIESGO

abrir ↗

Referência

CVE-2018-25387

CVE-2018-25387MEDIUM

HaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.php

33RIESGO

abrir ↗

Referência

CVE-2026-15703

CVE-2026-15703MEDIUM

SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection

33RIESGO

abrir ↗

Referência✓ VexDay Proof

CCProxy 6.2 - Telnet Proxy Ping Overflow (Metasploit)

CVE-2004-2685—remotewindows

Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long addre

28RIESGO

abrir ↗

Referência

CVE-2026-110013

CVE-2026-110013MEDIUM

Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token

33RIESGO

abrir ↗

Referência

CVE-2018-25386

CVE-2018-25386HIGH

HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php

41RIESGO

abrir ↗

Referência

CVE-2018-25385

CVE-2018-25385HIGH

E-Registrasi Pencak Silat 18.10 SQL Injection via id_partai

41RIESGO

abrir ↗

Referência

CVE-2018-25384

CVE-2018-25384MEDIUM

Wikidforum 2.20 Cross-Site Scripting via reply_text Parameter

33RIESGO

abrir ↗

Referência

CVE-2016-0752

CVE-2016-0752HIGHbajo ataque

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.

100RIESGO

abrir ↗

Referência

CVE-2026-81343

CVE-2026-81343MEDIUM

Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission

33RIESGO

abrir ↗

Referência

CVE-2024-58397

CVE-2024-58397MEDIUM

MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters

33RIESGO

abrir ↗

Referência

CVE-2026-13543

CVE-2026-13543MEDIUM

Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentication

33RIESGO

abrir ↗

Referência

CVE-2018-25366

CVE-2018-25366HIGH

CuteFTP 5.0 XP Buffer Overflow via Site Manager Label Field

41RIESGO

abrir ↗

Referência

CVE-2016-20069

CVE-2016-20069HIGH

WordPress Booking Calendar Contact Form 1.0.23 SQL Injection

41RIESGO

abrir ↗

Referência

CVE-2016-1823

CVE-2016-1823—

The IOHIDDevice::handleReportWithTime function in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and wa

23RIESGO

abrir ↗

Referência

CVE-2014-3704

CVE-2014-3704—

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct

60RIESGO

abrir ↗

Referência

CVE-2016-1885

CVE-2016-1885—

Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1

23RIESGO

abrir ↗

Referência

phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery

CVE-2019-12922—webappsphp

A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.

28RIESGO

abrir ↗

Referência

CVE-2026-10064

CVE-2026-10064MEDIUM

TRENDnet TEW-432BRP formSetPortTr stack-based overflow

33RIESGO

abrir ↗

Referência

CVE-2026-85407

CVE-2026-85407MEDIUM

Eleveo Quality Management Conversation events denial of service

33RIESGO

abrir ↗

Referência

CVE-2018-25365

CVE-2018-25365HIGH

PCViewer vt1000 Directory Traversal via GET Request

41RIESGO

abrir ↗

Referência

CVE-2026-85406

CVE-2026-85406MEDIUM

Eleveo Quality Management Conversation Review cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-19725

CVE-2026-19725CRITICAL

WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connect

48RIESGO

abrir ↗

Referência

CVE-2026-15695

CVE-2026-15695HIGH

Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-58476

CVE-2026-58476HIGH

Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests

41RIESGO

abrir ↗

Referência

CVE-2024-58388

CVE-2024-58388—

3RIESGO

abrir ↗

Referência

CVE-2026-11590

CVE-2026-11590HIGH

WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array Keys

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.