Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-105148
CVE-2026-105148MEDIUM
SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2018-6365
CVE-2018-6365—
SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page_new.php.
23RIESGO
abrir ↗
Referência
CVE-2018-6365
CVE-2018-6365—
SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page_new.php.
23RIESGO
abrir ↗
Referência
CVE-2022-26134
CVE-2022-26134CRITICALbajo ataqueransomware
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RIESGO
abrir ↗
Referência
CVE-2018-6367
CVE-2018-6367—
SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parame
23RIESGO
abrir ↗
Referência
CVE-2018-6367
CVE-2018-6367—
SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parame
23RIESGO
abrir ↗
Referência
CVE-2018-6368
CVE-2018-6368—
SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed acti
23RIESGO
abrir ↗
Referência
CVE-2026-105147
CVE-2026-105147MEDIUM
SciPhi-AI R2R JWT Secret hard-coded credentials
33RIESGO
abrir ↗
Referência
CVE-2018-6370
CVE-2018-6370—
SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file under
23RIESGO
abrir ↗
Referência
CVE-2026-105145
CVE-2026-105145MEDIUM
Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-104119
CVE-2026-104119LOW
Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials
28RIESGO
abrir ↗
Referência
CVE-2026-16196
CVE-2026-16196MEDIUM
Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-16195
CVE-2026-16195MEDIUM
Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization
33RIESGO
abrir ↗
Referência
CVE-2020-0674
CVE-2020-0674HIGHbajo ataque
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet
93RIESGO
abrir ↗
Referência
CVE-2026-16258
CVE-2026-16258CRITICAL
Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint
48RIESGO
abrir ↗
Referência
CVE-2026-102616
CVE-2026-102616MEDIUM
risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14314
CVE-2026-14314MEDIUM
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-14313
CVE-2026-14313MEDIUM
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Mambo Component Peoplebook 1.0 - Remote File Inclusion
CVE-2006-4195—webappsphp
PHP remote file inclusion vulnerability in param.peoplebook.php in the Peoplebook Component for Mambo (com_peoplebook) 1
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Spidey Blog Script 1.5 - 'proje_goster.asp' SQL Injection (1)
CVE-2006-4202—webappsasp
SQL injection vulnerability in proje_goster.php in Spidey Blog Script 1.5 and earlier allows remote attackers to execute
23RIESGO
abrir ↗
Referência
CVE-2018-17173
CVE-2018-17173—
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getT
50RIESGO
abrir ↗
Referência
CVE-2018-17173
CVE-2018-17173—
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getT
50RIESGO
abrir ↗
Referência
CVE-2026-85576
CVE-2026-85576MEDIUM
All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
33RIESGO
abrir ↗
Referência
CVE-2026-102913
CVE-2026-102913MEDIUM
SourceCodester Car Driving School Management System Master.php save_enrollment sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-102844
CVE-2026-102844MEDIUM
gedelumbung HospitalManagement laporan_data_pasien.php detail authorization
33RIESGO
abrir ↗
Referência
CVE-2026-15147
CVE-2026-15147MEDIUM
Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-10524
CVE-2026-10524HIGH
CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
41RIESGO
abrir ↗
Referência
CVE-2026-15495
CVE-2026-15495MEDIUM
SonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PHProjekt 5.1 - Multiple Remote File Inclusions
CVE-2006-4204—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PHProjekt 5.1 and possibly earlier allow remote attackers to execu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ProjectButler 0.8.4 - 'rootdir' Remote File Inclusion
CVE-2006-4205—webappsphp
Multiple PHP remote file inclusion vulnerabilities in WebDynamite ProjectButler 0.8.4 allow remote attackers to execute
23RIESGO
abrir ↗
← anteriorpágina 839 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.