Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência

CVE-2018-25375

CVE-2018-25375HIGH

SocuSoft iPod Photo Slideshow 8.05 Buffer Overflow SEH

41RIESGO

abrir ↗

Referência

CVE-2026-9477

CVE-2026-9477CRITICAL

Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection

48RIESGO

abrir ↗

Referência

CVE-2018-25374

CVE-2018-25374HIGH

Softneta MedDream PACS Server Premium 6.7.1.1 Directory Traversal

41RIESGO

abrir ↗

Referência

CVE-2026-13404

CVE-2026-13404MEDIUM

Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

33RIESGO

abrir ↗

Referência

CVE-2017-17639

CVE-2017-17639—

Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.

23RIESGO

abrir ↗

Referência

CVE-2019-13272

CVE-2019-13272HIGHbajo ataque

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce

98RIESGO

abrir ↗

Referência

CVE-2026-13172

CVE-2026-13172MEDIUM

Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-10186

CVE-2026-10186MEDIUM

code-projects Online Hospital Management System patient.php sql injection

33RIESGO

abrir ↗

Referência✓ VexDay Proof

ASP Stats Generator 2.1.1 - SQL Injection

CVE-2006-3184—webappsasp

Direct static code injection vulnerability in ASP Stats Generator before 2.1.2 allows remote authenticated attackers to

23RIESGO

abrir ↗

Referência✓ VexDay Proof

BandSite CMS 1.1.1 - 'ROOT_PATH' Remote File Inclusion

CVE-2006-3193—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Grayscale BandSite CMS 1.1.1, when register_globals is enabled, al

28RIESGO

abrir ↗

Referência

CVE-2026-8771

CVE-2026-8771MEDIUM

linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-8770

CVE-2026-8770MEDIUM

continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-8769

CVE-2026-8769MEDIUM

vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption

33RIESGO

abrir ↗

Referência

CVE-2026-8768

CVE-2026-8768MEDIUM

vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-8767

CVE-2026-8767LOW

vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection

28RIESGO

abrir ↗

Referência

CVE-2026-8766

CVE-2026-8766MEDIUM

Kilo-Org kilocode Environment Variable config.ts load information disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-8765

CVE-2026-8765MEDIUM

Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal

33RIESGO

abrir ↗

Referência

CVE-2017-12954

CVE-2017-12954—

The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of

23RIESGO

abrir ↗

Referência

CVE-2018-10068

CVE-2018-10068—

The jDownloads extension before 3.2.59 for Joomla! has XSS.

23RIESGO

abrir ↗

Referência

CVE-2021-47963

CVE-2021-47963MEDIUM

Anote 1.0 Persistent Cross-Site Scripting Leading to Code Execution

33RIESGO

abrir ↗

Referência

CVE-2017-5715

CVE-2017-5715MEDIUM

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl

55RIESGO

abrir ↗

Referência

CVE-2026-14287

CVE-2026-14287MEDIUM

TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass

33RIESGO

abrir ↗

Referência

CVE-2026-86444

CVE-2026-86444HIGH

LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter

41RIESGO

abrir ↗

Referência

CVE-2006-5190

CVE-2006-5190—

Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t

23RIESGO

abrir ↗

Referência

CVE-2026-92468

CVE-2026-92468HIGH

microservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center

41RIESGO

abrir ↗

Referência

CVE-2026-16985

CVE-2026-16985HIGH

Squeeze < 1.7.12 - Author+ Arbitrary File Upload

41RIESGO

abrir ↗

Referência

CVE-2026-88910

CVE-2026-88910MEDIUM

KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-17533

CVE-2026-17533HIGH

All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import

41RIESGO

abrir ↗

Referência

CVE-2026-10599

CVE-2026-10599HIGH

Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse

41RIESGO

abrir ↗

Referência

CVE-2017-15284

CVE-2017-15284—

Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG fil

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.