Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-15330
CVE-2026-15330MEDIUM
zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-104677
CVE-2026-104677HIGH
WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP
41RIESGO
abrir ↗
Referência
CVE-2026-120280
CVE-2026-120280CRITICAL
WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-120279
CVE-2026-120279CRITICAL
WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-15329
CVE-2026-15329MEDIUM
zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-15326
CVE-2026-15326MEDIUM
halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-15202
CVE-2026-15202MEDIUM
YzmCMS Header yzmphp.php get_url cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Gateway Weblaunch - ActiveX Control Insecure Method
CVE-2008-0220—remotewindows
Multiple stack-based buffer overflows in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.o
28RIESGO
abrir ↗
Referência✓ VexDay Proof
AShop Deluxe 4.x - 'catalogue.php' SQL Injection
CVE-2008-3136—webappsphp
SQL injection vulnerability in catalogue.php in AShop Deluxe 4.x allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência✓ VexDay Proof
SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (1)
CVE-2008-3152—webappsphp
SQL injection vulnerability in directory.php in SmartPPC and SmartPPC Pro allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência
CVE-2026-15321
CVE-2026-15321MEDIUM
MyEMS Admin Backend svg.py on_post cross site scripting
33RIESGO
abrir ↗
Referência
Joomla! Component Saxum Numerology 3.0.4 - SQL Injection
CVE-2018-7177—webappsphp
SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpMyRealty 2.0.0 - 'location' SQL Injection
CVE-2008-3445—webappsphp
SQL injection vulnerability in index.php in phpMyRealty (PMR) 2.0.0 allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência
CVE-2026-14630
CVE-2026-14630LOW
ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash
28RIESGO
abrir ↗
Referência
CVE-2026-12195
CVE-2026-12195HIGH
myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary c
41RIESGO
abrir ↗
Referência
CVE-2026-14625
CVE-2026-14625MEDIUM
NousResearch hermes-agent server.py shell.exec protection mechanism
33RIESGO
abrir ↗
Referência
CVE-2024-58352
CVE-2024-58352HIGH
Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do
41RIESGO
abrir ↗
Referência
CVE-2026-11965
CVE-2026-11965MEDIUM
User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership Bypass
33RIESGO
abrir ↗
Referência
CVE-2026-120231
CVE-2026-120231CRITICAL
WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-120230
CVE-2026-120230CRITICAL
WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-14623
CVE-2026-14623MEDIUM
omec-project amf NGAP Message RRCInactiveTransitionReport denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-14621
CVE-2026-14621LOW
FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session
28RIESGO
abrir ↗
Referência
CVE-2026-11781
CVE-2026-11781LOW
Adminify < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAX
28RIESGO
abrir ↗
Referência
CVE-2026-120229
CVE-2026-120229CRITICAL
WAVLINK WN553X1-B ioos sub_416B50 os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-120228
CVE-2026-120228CRITICAL
WAVLINK WN553X1-B ioos Service sub_416D88 os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-112139
CVE-2026-112139MEDIUM
subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-100898
CVE-2026-100898MEDIUM
DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
F-PROT AntiVirus 6.2.1.4252 - Malformed Archive Infinite Loop Denial of Service
CVE-2008-3447—dosmultiple
The scanning engine in F-Prot Antivirus 6.2.1 4252 allows remote attackers to cause a denial of service (infinite loop)
23RIESGO
abrir ↗
Referência
CVE-2026-11578
CVE-2026-11578LOW
Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR
28RIESGO
abrir ↗
Referência
CVE-2026-10077
CVE-2026-10077MEDIUM
YOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes
33RIESGO
abrir ↗
← anteriorpágina 829 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.