Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência

CVE-2019-7440

CVE-2019-7440—

JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_S

23RIESGO

abrir ↗

Referência

CVE-2016-20065

CVE-2016-20065HIGH

Product Catalog 8 1.2 Plugin WordPress SQL Injection

41RIESGO

abrir ↗

Referência

CVE-2026-4986

CVE-2026-4986MEDIUM

WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery

33RIESGO

abrir ↗

Referência

CVE-2026-12208

CVE-2026-12208MEDIUM

jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution

33RIESGO

abrir ↗

Referência

CVE-2026-12207

CVE-2026-12207MEDIUM

medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection

33RIESGO

abrir ↗

Referência

CVE-2014-8948

CVE-2014-8948—

Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows re

23RIESGO

abrir ↗

Referência

CVE-2026-12201

CVE-2026-12201MEDIUM

IObit Malware Fighter DLL permission

33RIESGO

abrir ↗

Referência

CVE-2026-11556

CVE-2026-11556HIGH

Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection

41RIESGO

abrir ↗

Referência✓ VexDay Proof

JiRos FAQ Manager 1.0 - 'index.asp' SQL Injection

CVE-2006-6149—webappsphp

SQL injection vulnerability in index.asp in JiRos FAQ Manager 1.0 allows remote attackers to execute arbitrary SQL comma

23RIESGO

abrir ↗

Referência

CVE-2026-11620

CVE-2026-11620MEDIUM

TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation

33RIESGO

abrir ↗

Referência

CVE-2026-11618

CVE-2026-11618MEDIUM

DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authentication

33RIESGO

abrir ↗

Referência

CVE-2014-8949

CVE-2014-8949—

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitr

23RIESGO

abrir ↗

Referência

CVE-2018-11646

CVE-2018-11646—

webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon

50RIESGO

abrir ↗

Referência

CVE-2018-1201

CVE-2018-1201—

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and vers

23RIESGO

abrir ↗

Referência

CVE-2018-19276

CVE-2018-19276CRITICAL

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated use

85RIESGO

abrir ↗

Referência

CVE-2026-84289

CVE-2026-84289MEDIUM

NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation

33RIESGO

abrir ↗

Referência

CVE-2026-84287

CVE-2026-84287MEDIUM

NousResearch hermes-agent Session Chat api_server.py denial of service

33RIESGO

abrir ↗

Referência

CVE-2026-84431

CVE-2026-84431MEDIUM

AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-78363

CVE-2026-78363MEDIUM

MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags

33RIESGO

abrir ↗

Referência

CVE-2026-82821

CVE-2026-82821MEDIUM

FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference

33RIESGO

abrir ↗

Referência

CVE-2026-82811

CVE-2026-82811MEDIUM

Toggl OÜ Toggl Track Extension postMessage origin validation

33RIESGO

abrir ↗

Referência

CVE-2026-82696

CVE-2026-82696MEDIUM

itsourcecode Sales and Inventory System inv_searchfrm.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2015-4118

CVE-2015-4118—

SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated user

23RIESGO

abrir ↗

Referência

CVE-2018-6193

CVE-2018-6193—

A Cross-Site Scripting (XSS) vulnerability was found in Routers2 2.24, affecting the 'rtr' GET parameter in a page=graph

23RIESGO

abrir ↗

Referência

CVE-2026-93314

CVE-2026-93314MEDIUM

Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow

33RIESGO

abrir ↗

Referência

CVE-2026-81845

CVE-2026-81845MEDIUM

arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-93313

CVE-2026-93313MEDIUM

Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow

33RIESGO

abrir ↗

Referência

CVE-2026-81847

CVE-2026-81847MEDIUM

MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal

33RIESGO

abrir ↗

Referência

CVE-2014-9097

CVE-2014-9097—

Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly

23RIESGO

abrir ↗

Referência

CVE-2020-11108

CVE-2020-11108—

The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abus

60RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.