Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-15546
CVE-2026-15546MEDIUM
Shibby Tomato start_jffs2 sub_2D568 os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-11563
CVE-2026-11563CRITICAL
Word Count and Social Shares <= 1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal
48RIESGO
abrir ↗
Referência
CVE-2020-35665
CVE-2020-35665—
An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in
60RIESGO
abrir ↗
Referência
CVE-2026-15545
CVE-2026-15545HIGH
Shibby Tomato apcupsd tomatodata.cgi main out-of-bounds write
41RIESGO
abrir ↗
Referência
CVE-2026-15544
CVE-2026-15544HIGH
Shibby Tomato apcupsd tomatodata.cgi getupsvar stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-93860
CVE-2026-93860HIGH
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the mainten
41RIESGO
abrir ↗
Referência
CVE-2026-94258
CVE-2026-94258LOW
SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions
28RIESGO
abrir ↗
Referência
CVE-2026-94246
CVE-2026-94246MEDIUM
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-94245
CVE-2026-94245MEDIUM
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-15749
CVE-2026-15749MEDIUM
mastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-58475
CVE-2026-58475MEDIUM
Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Site@School 2.4.10 - Blind SQL Injection
CVE-2008-0129—webappsphp
SQL injection vulnerability in starnet/addons/slideshow_full.php in Site@School 2.3.10 and earlier allows remote attacke
23RIESGO
abrir ↗
Referência✓ VexDay Proof
1Book Guestbook Script 1.0.1 - Code Execution
CVE-2008-2638—webappsphp
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitr
23RIESGO
abrir ↗
Referência
CVE-2020-7209
CVE-2020-7209—
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
60RIESGO
abrir ↗
Referência
CVE-2020-7246
CVE-2020-7246—
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code
60RIESGO
abrir ↗
Referência
CVE-2026-58448
CVE-2026-58448HIGH
yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API
41RIESGO
abrir ↗
Referência
CVE-2026-58447
CVE-2026-58447HIGH
Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check
41RIESGO
abrir ↗
Referência
CVE-2026-58446
CVE-2026-58446MEDIUM
Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-34111
CVE-2026-34111CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php
48RIESGO
abrir ↗
Referência
CVE-2026-34105
CVE-2026-34105HIGH
Guardian Language-System SQL Injection via id Parameter in translate_text.php
41RIESGO
abrir ↗
Referência
CVE-2026-34104
CVE-2026-34104HIGH
Guardian Language-System SQL Injection via name Parameter in designer.php
41RIESGO
abrir ↗
Referência
CVE-2026-11887
CVE-2026-11887MEDIUM
Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass
33RIESGO
abrir ↗
Referência✓ VexDay Proof
ZeroCMS 1.0 Alpha - Arbitrary File Upload / SQL Injection
CVE-2008-0232—webappsphp
Multiple SQL injection vulnerabilities in Zero CMS 1.0 Alpha allow remote attackers to execute arbitrary SQL commands vi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ResearchGuide 0.5 - 'id' SQL Injection
CVE-2008-2964—webappsphp
SQL injection vulnerability in guide.php in ResearchGuide 0.5 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2026-105245
CVE-2026-105245MEDIUM
sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission
33RIESGO
abrir ↗
Referência
CVE-2026-105238
CVE-2026-105238MEDIUM
ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-12780
CVE-2026-12780HIGH
AOMEI Backupper Kernel Driver amwrtdrv.sys access control
41RIESGO
abrir ↗
Referência✓ VexDay Proof
IAPR COMMENCE 1.3 - Multiple Remote File Inclusions
CVE-2007-6147—webappsphp
Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Toshiba Surveillance - 'MeIpCamX.dll 1.0.0.4' Remote Buffer Overflow
CVE-2008-0399—remotewindows
Multiple buffer overflows in Toshiba Surveillance (Surveillix) RecordSend ActiveX control (MeIpCamX.DLL 1.0.0.4) allow r
23RIESGO
abrir ↗
Referência
CVE-2026-9822
CVE-2026-9822MEDIUM
WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers
33RIESGO
abrir ↗
← anteriorpágina 817 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.