Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-78166
CVE-2026-78166MEDIUM
provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection
33RIESGO
abrir ↗
Referência
CVE-2026-16334
CVE-2026-16334MEDIUM
itsourcecode Hospital Management System prescriptionorder.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-71510
CVE-2026-71510HIGH
Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter
41RIESGO
abrir ↗
Referência
CVE-2026-15624
CVE-2026-15624MEDIUM
nextlevelbuilder GoClaw invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2017-8473
CVE-2017-8473—
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, an
23RIESGO
abrir ↗
Referência
CVE-2026-18234
CVE-2026-18234MEDIUM
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Easy File Sharing Web Server 4 - Remote Information Stealer
CVE-2006-5714—remotewindows
Easy File Sharing (EFS) Web Server 4.0, when running on an NTFS file system, allows remote attackers to read arbitrary f
23RIESGO
abrir ↗
Referência✓ VexDay Proof
EFS Easy Address Book Web Server 1.2 - Remote File Stream
CVE-2006-5715—remotewindows
Easy File Sharing (EFS) Easy Address Book 1.2, when run on an NTFS file system, allows remote attackers to read arbitrar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Friendly 1.0d1 - 'friendly_path' Remote File Inclusion
CVE-2007-2569—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Friendly 1.0d1 and earlier allow remote attackers to execute arbit
23RIESGO
abrir ↗
Referência
CVE-2026-10270
CVE-2026-10270HIGH
D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-10268
CVE-2026-10268MEDIUM
janet-lang janet marsh.c unmarshal_one_fiber integer overflow
33RIESGO
abrir ↗
Referência
CVE-2019-19726
CVE-2019-19726—
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be
38RIESGO
abrir ↗
Referência
CVE-2026-14206
CVE-2026-14206HIGH
HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure
41RIESGO
abrir ↗
Referência
CVE-2017-17575
CVE-2017-17575—
FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17579
CVE-2017-17579—
FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-11559
CVE-2026-11559MEDIUM
CodeAstro Payroll System view_account.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-25555
CVE-2026-25555CRITICAL
OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header
63RIESGO
abrir ↗
Referência
CVE-2026-34416
CVE-2026-34416MEDIUM
OSCAL-GUI Reflected XSS via project parameter in oscal.php
33RIESGO
abrir ↗
Referência
CVE-2026-19986
CVE-2026-19986MEDIUM
Adblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization
33RIESGO
abrir ↗
Referência
CVE-2018-18800
CVE-2018-18800—
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=
23RIESGO
abrir ↗
Referência
CVE-2019-19781
CVE-2019-19781CRITICALbajo ataqueransomware
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RIESGO
abrir ↗
Referência
CVE-2019-19781
CVE-2019-19781CRITICALbajo ataqueransomware
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RIESGO
abrir ↗
Referência
CVE-2026-18927
CVE-2026-18927MEDIUM
imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-19191
CVE-2026-19191HIGH
StableBit DrivePool DrivePoolService DrivePool.Service.exe permission
41RIESGO
abrir ↗
Referência
CVE-2026-16993
CVE-2026-16993LOW
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
28RIESGO
abrir ↗
Referência
CVE-2026-16981
CVE-2026-16981MEDIUM
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-19020
CVE-2026-19020MEDIUM
itsourcecode Hospital Management System servicetype.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2017-17604
CVE-2017-17604—
Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17606
CVE-2017-17606—
Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-19034
CVE-2026-19034HIGH
Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection
41RIESGO
abrir ↗
← anteriorpágina 822 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.