Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-79911
CVE-2026-79911CRITICAL
TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow
48RIESGO
abrir ↗
Referência
CVE-2026-79792
CVE-2026-79792MEDIUM
zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-78112
CVE-2026-78112MEDIUM
itsourcecode Hospital Management System Project in PHP viewservicetype.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-78140
CVE-2026-78140MEDIUM
Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Vizayn Urun Tanitim Sistemi 0.2 - 'tr' SQL Injection
CVE-2007-2803—webappsasp
SQL injection vulnerability in default.asp in Vizayn Urun Tanitim Sitesi 0.2 allows remote attackers to execute arbitrar
23RIESGO
abrir ↗
Referência
CVE-2017-17598
CVE-2017-17598—
Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPECard 2.1.4 - 'functions.php' Remote File Inclusion
CVE-2006-4456—webappsphp
PHP remote file inclusion vulnerability in functions.php in phpECard 2.1.4 and earlier allows remote attackers to execut
23RIESGO
abrir ↗
Referência
CVE-2017-8594
CVE-2017-8594—
Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute
35RIESGO
abrir ↗
Referência
CVE-2017-17639
CVE-2017-17639—
Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17759
CVE-2017-17759—
Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of
28RIESGO
abrir ↗
Referência
CVE-2018-12254
CVE-2018-12254—
router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 component for Joomla! allows SQL Injection via the PATH_INFO to
23RIESGO
abrir ↗
Referência
CVE-2026-12396
CVE-2026-12396MEDIUM
WP Job Portal < 2.5.5 - Subscriber+ Arbitrary Job Approval, Featuring and Rejection
33RIESGO
abrir ↗
Referência
CVE-2026-15622
CVE-2026-15622MEDIUM
poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization
33RIESGO
abrir ↗
Referência
CVE-2026-15595
CVE-2026-15595MEDIUM
SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2017-2460
CVE-2017-2460—
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RIESGO
abrir ↗
Referência
CVE-2026-12275
CVE-2026-12275HIGH
Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration
41RIESGO
abrir ↗
Referência
CVE-2026-90576
CVE-2026-90576MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereference
33RIESGO
abrir ↗
Referência
CVE-2026-90691
CVE-2026-90691MEDIUM
0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-90690
CVE-2026-90690MEDIUM
0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-90575
CVE-2026-90575MEDIUM
PHPGurukul Small CRM Login Success login.php unserialize deserialization
33RIESGO
abrir ↗
Referência
CVE-2026-12274
CVE-2026-12274MEDIUM
Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-12273
CVE-2026-12273MEDIUM
Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation
33RIESGO
abrir ↗
Referência
CVE-2017-2478
CVE-2017-2478—
An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS b
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Microsoft Internet Explorer 6 / Ademco co. ltd. ATNBaseLoader100 Module - Remote Buffer Overflow
CVE-2007-2938—remotewindows
Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) 5.4.0.6,
35RIESGO
abrir ↗
Referência
CVE-2026-75078
CVE-2026-75078MEDIUM
SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
FlaP 1.0b - 'pachtofile' Remote File Inclusion
CVE-2007-2940—webappsphp
Multiple PHP remote file inclusion vulnerabilities in FlaP 1.0b (1.0 Beta) allow remote attackers to execute arbitrary P
23RIESGO
abrir ↗
Referência
CVE-2026-58478
CVE-2026-58478MEDIUM
Sustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URL
33RIESGO
abrir ↗
Referência
CVE-2026-55200
CVE-2026-55200CRITICAL
libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
48RIESGO
abrir ↗
Referência
CVE-2015-2426
CVE-2015-2426HIGHbajo ataque
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2
100RIESGO
abrir ↗
Referência
CVE-2026-15241
CVE-2026-15241HIGH
ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response
41RIESGO
abrir ↗
← anteriorpágina 827 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.