Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2018-15745
CVE-2018-15745—
Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F
60RIESGO
abrir ↗
Referência
CVE-2026-90844
CVE-2026-90844MEDIUM
PHPGurukul Daily Expense Tracker System Login index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-16121
CVE-2026-16121MEDIUM
nextlevelbuilder GoClaw exec_approval.go isSafeBin improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-14291
CVE-2026-14291HIGH
Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa
41RIESGO
abrir ↗
Referência
CVE-2019-16759
CVE-2019-16759CRITICALbajo ataque
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RIESGO
abrir ↗
Referência
CVE-2026-18896
CVE-2026-18896MEDIUM
lavkush-maurya Student-Registration-System changepass.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-77694
CVE-2026-77694MEDIUM
Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token
33RIESGO
abrir ↗
Referência
CVE-2026-78638
CVE-2026-78638MEDIUM
peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-78161
CVE-2026-78161MEDIUM
warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write
33RIESGO
abrir ↗
Referência
CVE-2026-78138
CVE-2026-78138MEDIUM
Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html
33RIESGO
abrir ↗
Referência
CVE-2026-78201
CVE-2026-78201MEDIUM
itsourcecode Payroll System admin_class.php login sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-77945
CVE-2026-77945MEDIUM
TRENDnet TEW-821DAP ssi upload.cgi command injection
33RIESGO
abrir ↗
Referência
CVE-2017-16836
CVE-2017-16836—
Arris TG1682G devices with Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MiniBB 2.0.2 - 'bb_func_txt.php' Remote File Inclusion
CVE-2006-5673—webappsphp
PHP remote file inclusion vulnerability in bb_func_txt.php in miniBB 2.0.2 and earlier, when register_globals is enabled
23RIESGO
abrir ↗
Referência
CVE-2026-78200
CVE-2026-78200MEDIUM
itsourcecode Library Management System editbooks.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-78199
CVE-2026-78199MEDIUM
SourceCodester Simple Online Food Ordering System view_prod.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-77946
CVE-2026-77946CRITICAL
TRENDnet TEW-821DAP NTP Timezone Configuration apply_time.cgi uci_safe_get stack-based overflow
48RIESGO
abrir ↗
Referência✓ VexDay Proof
MySource CMS 2.16.2 - 'init_mysource.php' Remote File Inclusion
CVE-2006-5672—webappsphp
PHP remote file inclusion vulnerability in web/init_mysource.php in MySource CMS 2.16.2 and earlier allows remote attack
23RIESGO
abrir ↗
Referência
CVE-2026-14212
CVE-2026-14212MEDIUM
Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-72705 — Rocq Guard Checker Accepts Fixpoint Passed as Higher-Order Argument
CVE-2026-72705MEDIUM
Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument
33RIESGO
abrir ↗
Referência
CVE-2026-13414
CVE-2026-13414MEDIUM
CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax
33RIESGO
abrir ↗
Referência
CVE-2026-17540
CVE-2026-17540HIGH
Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch
56RIESGO
abrir ↗
Referência
CVE-2017-17595
CVE-2017-17595—
Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Hpecs Shopping Cart - Remote Authentication Bypass
CVE-2006-5962—webappsasp
Multiple SQL injection vulnerabilities in Hpecs Shopping Cart allow remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗
Referência
CVE-2026-110524
CVE-2026-110524MEDIUM
Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute
33RIESGO
abrir ↗
Referência
CVE-2017-17596
CVE-2017-17596—
Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17599
CVE-2017-17599—
Advance Online Learning Management Script 3.1 has SQL Injection via the courselist.php subcatid or popcourseid parameter
23RIESGO
abrir ↗
Referência
CVE-2017-17599
CVE-2017-17599—
Advance Online Learning Management Script 3.1 has SQL Injection via the courselist.php subcatid or popcourseid parameter
23RIESGO
abrir ↗
Referência
CVE-2026-107100
CVE-2026-107100MEDIUM
Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content
33RIESGO
abrir ↗
Referência
CVE-2026-19380
CVE-2026-19380MEDIUM
Mullvad wireguard.sys IOCTL AdapterState reference count
33RIESGO
abrir ↗
← anteriorpágina 830 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.