Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência

CVE-2026-58172

CVE-2026-58172CRITICAL

Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests

48RIESGO

abrir ↗

Referência

CVE-2026-58166

CVE-2026-58166HIGH

OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete

41RIESGO

abrir ↗

Referência

CVE-2026-58116

CVE-2026-58116CRITICAL

LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path

48RIESGO

abrir ↗

Referência✓ VexDay Proof

crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow

CVE-2006-1236—remotelinux

Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrar

28RIESGO

abrir ↗

Referência

CVE-2020-37236

CVE-2020-37236MEDIUM

NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel

33RIESGO

abrir ↗

Referência✓ VexDay Proof

NEWSolved Lite 1.9.2 - 'abs_path' Remote File Inclusion

CVE-2006-4059—webappsphp

Multiple PHP remote file inclusion vulnerabilities in USOLVED NEWSolved Lite 1.9.2, and possibly earlier, allow remote a

28RIESGO

abrir ↗

Referência

CVE-2020-37235

CVE-2020-37235MEDIUM

WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component

33RIESGO

abrir ↗

Referência

CVE-2025-12669

CVE-2025-12669MEDIUM

Improper Control of Generation of Code ('Code Injection') in GitLab

33RIESGO

abrir ↗

Referência

CVE-2025-13874

CVE-2025-13874MEDIUM

Authorization Bypass Through User-Controlled Key in GitLab

33RIESGO

abrir ↗

Referência

CVE-2025-14869

CVE-2025-14869HIGH

Improper Validation of Specified Quantity in Input in GitLab

41RIESGO

abrir ↗

Referência

CVE-2025-14870

CVE-2025-14870HIGH

Allocation of Resources Without Limits or Throttling in GitLab

41RIESGO

abrir ↗

Referência

CVE-2026-3607

CVE-2026-3607MEDIUM

Access Control Check Implemented After Asset is Accessed in GitLab

33RIESGO

abrir ↗

Referência

CVE-2020-37234

CVE-2020-37234MEDIUM

Internet Download Manager 6.38.12 Scheduler Buffer Overflow

33RIESGO

abrir ↗

Referência

CVE-2020-37233

CVE-2020-37233MEDIUM

WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting

33RIESGO

abrir ↗

Referência

CVE-2020-37230

CVE-2020-37230HIGH

Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation

41RIESGO

abrir ↗

Referência

CVE-2020-37229

CVE-2020-37229HIGH

OKI sPSV Port Manager 1.0.41 Unquoted Service Path Privilege Escalation

41RIESGO

abrir ↗

Referência

CVE-2021-47965

CVE-2021-47965CRITICAL

WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload

48RIESGO

abrir ↗

Referência

CVE-2026-9478

CVE-2026-9478CRITICAL

Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection

48RIESGO

abrir ↗

Referência✓ VexDay Proof

Apple Mac OSX Safari 2.0.3 (417.9.2) - 'ROWSPAN' Denial of Service (PoC)

CVE-2006-2019—dososx

Apple Mac OS X Safari 2.0.3, 1.3.1, and possibly other versions allows remote attackers to cause a denial of service (CP

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Limbo CMS 1.0.4.2 - 'sql.php' Remote File Inclusion

CVE-2006-2142—webappsphp

PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Aardvark Topsites PHP 4.2.2 - 'lostpw.php' Remote File Inclusion

CVE-2006-2149—webappsphp

PHP remote file inclusion vulnerability in sources/lostpw.php in Aardvark Topsites PHP 4.2.2 and earlier, when register_

23RIESGO

abrir ↗

Referência

CVE-2026-17517

CVE-2026-17517MEDIUM

Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter

33RIESGO

abrir ↗

Referência

CVE-2026-15247

CVE-2026-15247MEDIUM

Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion

33RIESGO

abrir ↗

Referência

CVE-2019-3396

CVE-2019-3396CRITICALbajo ataqueransomware

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers

100RIESGO

abrir ↗

Referência

CVE-2026-19231

CVE-2026-19231MEDIUM

SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-13344

CVE-2026-13344MEDIUM

Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag

33RIESGO

abrir ↗

Referência

CVE-2026-19704

CVE-2026-19704MEDIUM

Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi

33RIESGO

abrir ↗

Referência

CVE-2026-83744

CVE-2026-83744MEDIUM

invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2018-5405

CVE-2018-5405—

The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.

23RIESGO

abrir ↗

Referência

CVE-2026-104050

CVE-2026-104050MEDIUM

Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.