Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência

CVE-2024-8945

CVE-2024-8945MEDIUM

CodeCanyon RISE Ultimate Project Manager save sql injection

38RIESGO

abrir ↗

Referência

CVE-2026-76640

CVE-2026-76640HIGH

Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack

41RIESGO

abrir ↗

Referência

CVE-2026-75798

CVE-2026-75798MEDIUM

AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant

33RIESGO

abrir ↗

Referência

CVE-2026-92457

CVE-2026-92457HIGH

yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice

41RIESGO

abrir ↗

Referência

CVE-2026-92456

CVE-2026-92456HIGH

yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints

41RIESGO

abrir ↗

Referência

CVE-2026-1168

CVE-2026-1168HIGH

Allocation of Resources Without Limits or Throttling in GitLab

41RIESGO

abrir ↗

Referência

CVE-2026-3855

CVE-2026-3855LOW

Improper Control of Resource Identifiers ('Resource Injection') in GitLab

28RIESGO

abrir ↗

Referência

CVE-2015-6098

CVE-2015-6098—

Buffer overflow in the Network Driver Interface Standard (NDIS) implementation in Microsoft Windows Vista SP2, Windows S

23RIESGO

abrir ↗

Referência

CVE-2016-9565

CVE-2016-9565—

MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write

28RIESGO

abrir ↗

Referência

CVE-2026-75417

CVE-2026-75417HIGH

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within applicat

41RIESGO

abrir ↗

Referência

CVE-2017-0037

CVE-2017-0037HIGHbajo ataque

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilde

93RIESGO

abrir ↗

Referência

CVE-2026-16984

CVE-2026-16984MEDIUM

WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure

33RIESGO

abrir ↗

Referência

CVE-2017-0037

CVE-2017-0037HIGHbajo ataque

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilde

93RIESGO

abrir ↗

Referência✓ VexDay Proof

Eskolar CMS 0.9.0.0 - Blind SQL Injection

CVE-2006-3727—webappsphp

Multiple SQL injection vulnerabilities in Eskolar CMS 0.9.0.0 allow remote attackers to execute arbitrary SQL commands v

23RIESGO

abrir ↗

Referência

CVE-2026-7514

CVE-2026-7514MEDIUM

Missing Authorization in GitLab

33RIESGO

abrir ↗

Referência

CVE-2026-8030

CVE-2026-8030MEDIUM

Missing Authorization in GitLab

33RIESGO

abrir ↗

Referência

CVE-2026-18943

CVE-2026-18943MEDIUM

WPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-87896

CVE-2026-87896MEDIUM

Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route

33RIESGO

abrir ↗

Referência

CVE-2026-87860

CVE-2026-87860MEDIUM

Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

33RIESGO

abrir ↗

Referência

CVE-2026-87854

CVE-2026-87854MEDIUM

Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

33RIESGO

abrir ↗

Referência

CVE-2026-15229

CVE-2026-15229MEDIUM

Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

33RIESGO

abrir ↗

Referência

CVE-2026-18960

CVE-2026-18960MEDIUM

Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords

33RIESGO

abrir ↗

Referência

CVE-2020-27533

CVE-2020-27533—

A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to

23RIESGO

abrir ↗

Referência

CVE-2020-28978

CVE-2020-28978—

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a

28RIESGO

abrir ↗

Referência

CVE-2017-8841

CVE-2017-8841—

Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b30

23RIESGO

abrir ↗

Referência

CVE-2021-42013

CVE-2021-42013CRITICALbajo ataqueransomware

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RIESGO

abrir ↗

Referência

CVE-2026-18946

CVE-2026-18946HIGH

Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename

41RIESGO

abrir ↗

Referência✓ VexDay Proof

Mambo Component MoSpray 18RC1 - Remote File Inclusion

CVE-2006-3847—webappsphp

PHP remote file inclusion vulnerability in (1) admin.php, and possibly (2) details.php, (3) modify.php, (4) newgroup.php

23RIESGO

abrir ↗

Referência✓ VexDay Proof

X7 Chat 2.0.4 - 'old_prefix' Blind SQL Injection

CVE-2006-3851—webappsphp

SQL injection vulnerability in upgradev1.php in X7 Chat 2.0.4 and earlier allows remote attackers to execute arbitrary S

23RIESGO

abrir ↗

Referência

CVE-2026-14860

CVE-2026-14860MEDIUM

Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.