Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-13415
CVE-2026-13415HIGH
CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings
41RIESGO
abrir ↗
Referência✓ VexDay Proof
iPrimal Forums - '/admin/index.php' Remote File Inclusion
CVE-2006-5788—webappsphp
PHP remote file inclusion vulnerability in (1) index.php and (2) admin/index.php in IPrimal Forums as of 20061105 allows
23RIESGO
abrir ↗
Referência
CVE-2026-83544
CVE-2026-83544MEDIUM
Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute
33RIESGO
abrir ↗
Referência
CVE-2026-66731
CVE-2026-66731HIGH
facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
41RIESGO
abrir ↗
Referência
CVE-2026-109440
CVE-2026-109440HIGH
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
41RIESGO
abrir ↗
Referência
CVE-2026-113356
CVE-2026-113356HIGH
DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
41RIESGO
abrir ↗
Referência
CVE-2026-84887
CVE-2026-84887MEDIUM
simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
33RIESGO
abrir ↗
Referência
CVE-2021-43481
CVE-2021-43481—
An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstag
23RIESGO
abrir ↗
Referência
CVE-2024-6244
CVE-2024-6244HIGH
pz-frontend-manager < 1.0.6 - CSRF change user profile picture
41RIESGO
abrir ↗
Referência
CVE-2026-77004
CVE-2026-77004MEDIUM
Comfast CF-N1-S mbox-config sprintf command injection
33RIESGO
abrir ↗
Referência
CVE-2026-66730
CVE-2026-66730HIGH
facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser
41RIESGO
abrir ↗
Referência
CVE-2026-66729
CVE-2026-66729HIGH
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
41RIESGO
abrir ↗
Referência
CVE-2026-82667
CVE-2026-82667MEDIUM
yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2020-10963
CVE-2020-10963—
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution)
28RIESGO
abrir ↗
Referência
CVE-2018-18776
CVE-2018-18776—
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (
23RIESGO
abrir ↗
Referência
CVE-2018-18776
CVE-2018-18776—
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (
23RIESGO
abrir ↗
Referência
CVE-2018-18777
CVE-2018-18777—
Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subp
43RIESGO
abrir ↗
Referência
CVE-2026-112101
CVE-2026-112101MEDIUM
BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
33RIESGO
abrir ↗
Referência
CVE-2026-13174
CVE-2026-13174HIGH
Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR
41RIESGO
abrir ↗
Referência
CVE-2025-15686
CVE-2025-15686MEDIUM
Open5GS HSS Service fd_msg_sess_get denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-73030
CVE-2026-73030HIGH
unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape
41RIESGO
abrir ↗
Referência
CVE-2026-69116
CVE-2026-69116MEDIUM
FlyEnv < 4.18.0 Cross-Site Scripting via v-html
33RIESGO
abrir ↗
Referência
Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution
CVE-2019-12735—locallinux
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via th
28RIESGO
abrir ↗
Referência
CVE-2026-18470
CVE-2026-18470HIGH
Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response
41RIESGO
abrir ↗
Referência
CVE-2024-14042
CVE-2024-14042MEDIUM
Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflow
33RIESGO
abrir ↗
Referência
CVE-2018-18924
CVE-2018-18924—
The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file
23RIESGO
abrir ↗
Referência
CVE-2026-111274
CVE-2026-111274MEDIUM
unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields
33RIESGO
abrir ↗
Referência
CVE-2026-69114
CVE-2026-69114HIGH
Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass
41RIESGO
abrir ↗
Referência
CVE-2026-111150
CVE-2026-111150MEDIUM
ValleyBell libvgm through commit a6eed945 Heap Out-of-Bounds Read via DecompressDataBlk
33RIESGO
abrir ↗
Referência
CVE-2026-70622
CVE-2026-70622HIGH
tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()
41RIESGO
abrir ↗
← anteriorpágina 840 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.