Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-15237
CVE-2026-15237MEDIUM
Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-9478
CVE-2026-9478CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection
48RIESGO
abrir ↗
Referência✓ VexDay Proof
Apple Mac OSX Safari 2.0.3 (417.9.2) - 'ROWSPAN' Denial of Service (PoC)
CVE-2006-2019—dososx
Apple Mac OS X Safari 2.0.3, 1.3.1, and possibly other versions allows remote attackers to cause a denial of service (CP
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Limbo CMS 1.0.4.2 - 'sql.php' Remote File Inclusion
CVE-2006-2142—webappsphp
PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Aardvark Topsites PHP 4.2.2 - 'lostpw.php' Remote File Inclusion
CVE-2006-2149—webappsphp
PHP remote file inclusion vulnerability in sources/lostpw.php in Aardvark Topsites PHP 4.2.2 and earlier, when register_
23RIESGO
abrir ↗
Referência
CVE-2026-17517
CVE-2026-17517MEDIUM
Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter
33RIESGO
abrir ↗
Referência
CVE-2026-15247
CVE-2026-15247MEDIUM
Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion
33RIESGO
abrir ↗
Referência
CVE-2019-3396
CVE-2019-3396CRITICALbajo ataqueransomware
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers
100RIESGO
abrir ↗
Referência
CVE-2026-19231
CVE-2026-19231MEDIUM
SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-13344
CVE-2026-13344MEDIUM
Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag
33RIESGO
abrir ↗
Referência
CVE-2026-19704
CVE-2026-19704MEDIUM
Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi
33RIESGO
abrir ↗
Referência
CVE-2026-83744
CVE-2026-83744MEDIUM
invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2018-5405
CVE-2018-5405—
The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.
23RIESGO
abrir ↗
Referência
CVE-2026-104050
CVE-2026-104050MEDIUM
Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers
33RIESGO
abrir ↗
Referência
CVE-2026-77826
CVE-2026-77826HIGH
RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation
41RIESGO
abrir ↗
Referência
CVE-2026-19719
CVE-2026-19719MEDIUM
Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Contributor+ Stored XSS via Post Title
33RIESGO
abrir ↗
Referência✓ VexDay Proof
ACal 2.2.6 - 'day.php' Remote File Inclusion
CVE-2006-2261—webappsphp
PHP remote file inclusion vulnerability in day.php in ACal 2.2.6 allows remote attackers to execute arbitrary PHP code v
23RIESGO
abrir ↗
Referência
CVE-2026-15257
CVE-2026-15257MEDIUM
RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification
33RIESGO
abrir ↗
Referência
CVE-2026-89289
CVE-2026-89289MEDIUM
Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint
33RIESGO
abrir ↗
Referência
CVE-2018-5723
CVE-2018-5723—
MASTER IPCAMERA01 3.3.4.2103 devices have a hardcoded password of cat1029 for the root account.
23RIESGO
abrir ↗
Referência
CVE-2018-5751
CVE-2018-5751—
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4
23RIESGO
abrir ↗
Referência
CVE-2026-94278
CVE-2026-94278MEDIUM
File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat
33RIESGO
abrir ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RIESGO
abrir ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RIESGO
abrir ↗
Referência
CVE-2018-6892
CVE-2018-6892—
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RIESGO
abrir ↗
Referência
CVE-2026-67216
CVE-2026-67216HIGH
cJSON cJSON_Compare Exponential Complexity Denial of Service
41RIESGO
abrir ↗
Referência
CVE-2026-67215
CVE-2026-67215HIGH
cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion
41RIESGO
abrir ↗
Referência
CVE-2026-105172
CVE-2026-105172MEDIUM
itsourcecode Online Admission System login1.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-41924
CVE-2026-41924CRITICAL
WDR201A WiFi Extender OS Command Injection via makeRequest.cgi
48RIESGO
abrir ↗
Referência
CVE-2026-41923
CVE-2026-41923CRITICAL
WDR201A WiFi Extender OS Command Injection via internet.cgi
48RIESGO
abrir ↗
← anteriorpágina 835 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.