Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-11590
CVE-2026-11590HIGH
WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array Keys
41RIESGO
abrir ↗
Referência
CVE-2026-9531
CVE-2026-9531MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection
38RIESGO
abrir ↗
Referência
CVE-2026-9485
CVE-2026-9485MEDIUM
SourceCodester Student Grades Management System students.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-11484
CVE-2026-11484MEDIUM
SourceCodester Class and Exam Timetabling System archive3.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-11483
CVE-2026-11483MEDIUM
SourceCodester Class and Exam Timetabling System archive4.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-9532
CVE-2026-9532MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection
38RIESGO
abrir ↗
Referência
CVE-2014-3974
CVE-2014-3974—
Cross-site scripting (XSS) vulnerability in filemanager.php in AuraCMS 3.0 and earlier allows remote attackers to inject
23RIESGO
abrir ↗
Referência
CVE-2026-11589
CVE-2026-11589HIGH
WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Stored XSS via File Upload
41RIESGO
abrir ↗
Referência
CVE-2026-15497
CVE-2026-15497MEDIUM
SonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection
33RIESGO
abrir ↗
Referência
CVE-2017-11918
CVE-2017-11918—
ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to
35RIESGO
abrir ↗
Referência
CVE-2026-94260
CVE-2026-94260MEDIUM
Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure
33RIESGO
abrir ↗
Referência
CVE-2014-4710
CVE-2014-4710—
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbit
23RIESGO
abrir ↗
Referência
CVE-2026-9515
CVE-2026-9515MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection
38RIESGO
abrir ↗
Referência
CVE-2026-9514
CVE-2026-9514MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection
38RIESGO
abrir ↗
Referência
CVE-2026-16205
CVE-2026-16205MEDIUM
Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-110107
CVE-2026-110107LOW
RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
28RIESGO
abrir ↗
Referência
CVE-2026-8212
CVE-2026-8212MEDIUM
OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-90976
CVE-2026-90976MEDIUM
Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled
33RIESGO
abrir ↗
Referência
CVE-2026-85022
CVE-2026-85022MEDIUM
langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-8211
CVE-2026-8211MEDIUM
codelibs Fess JSP File AdminDesignAction.java update code injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Multiple Membership Script 2.5 - 'id' SQL Injection
CVE-2008-6362—webappsphp
SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2014-7222
CVE-2014-7222—
Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (a
28RIESGO
abrir ↗
Referência
CVE-2011-4809
CVE-2011-4809—
Multiple cross-site scripting (XSS) vulnerabilities in the HM Community (com_hmcommunity) component before 1.01 for Joom
23RIESGO
abrir ↗
Referência
CVE-2026-9475
CVE-2026-9475CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-9474
CVE-2026-9474MEDIUM
yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection
33RIESGO
abrir ↗
Referência
CVE-2017-12542
CVE-2017-12542—
A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53
60RIESGO
abrir ↗
Referência
CVE-2026-9473
CVE-2026-9473MEDIUM
c-rick jimeng-mcp api.ts generateVideo path traversal
33RIESGO
abrir ↗
Referência
CVE-2014-4311
CVE-2014-4311—
Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allows attackers to obtain the (1) Database Connection and (2) E-mai
23RIESGO
abrir ↗
Referência
CVE-2026-18774
CVE-2026-18774MEDIUM
NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-9455
CVE-2026-9455CRITICAL
Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection
48RIESGO
abrir ↗
← anteriorpágina 808 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.