Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-12684
CVE-2026-12684MEDIUM
Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media
33RIESGO
abrir ↗
Referência
CVE-2026-15522
CVE-2026-15522MEDIUM
tugcantopaloglu godot-mcp run_project index.js validatePath path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-12585
CVE-2026-12585HIGH
Abandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link Token
41RIESGO
abrir ↗
Referência
CVE-2026-12525
CVE-2026-12525HIGH
Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator
41RIESGO
abrir ↗
Referência
CVE-2026-87971
CVE-2026-87971HIGH
If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-15521
CVE-2026-15521MEDIUM
makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Efestech Shop 2.0 - 'cat_id' SQL Injection
CVE-2008-3030—webappsphp
SQL injection vulnerability in default.asp in EfesTECH Shop 2.0 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência✓ VexDay Proof
XchangeBoard 1.70 - 'boardID' SQL Injection
CVE-2008-3035—webappsphp
SQL injection vulnerability in newThread.php in XchangeBoard 1.70 Final and earlier allows remote authenticated users to
23RIESGO
abrir ↗
Referência
CVE-2026-15518
CVE-2026-15518MEDIUM
AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-15517
CVE-2026-15517MEDIUM
Jinher OA PlanGiveOut.aspx sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-15516
CVE-2026-15516MEDIUM
MacCMS Pro Installation Index.php step5 authorization
33RIESGO
abrir ↗
Referência✓ VexDay Proof
CMS little 0.0.1 - 'template' Local File Inclusion
CVE-2008-3036—webappsphp
Directory traversal vulnerability in index.php in CMS little 0.0.1 allows remote attackers to include and execute arbitr
23RIESGO
abrir ↗
Referência
Joomla! Component Saxum Numerology 3.0.4 - SQL Injection
CVE-2018-7177—webappsphp
SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpMyRealty 2.0.0 - 'location' SQL Injection
CVE-2008-3445—webappsphp
SQL injection vulnerability in index.php in phpMyRealty (PMR) 2.0.0 allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência
CVE-2026-14630
CVE-2026-14630LOW
ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash
28RIESGO
abrir ↗
Referência
CVE-2026-12195
CVE-2026-12195HIGH
myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary c
41RIESGO
abrir ↗
Referência
CVE-2026-14625
CVE-2026-14625MEDIUM
NousResearch hermes-agent server.py shell.exec protection mechanism
33RIESGO
abrir ↗
Referência
CVE-2024-58352
CVE-2024-58352HIGH
Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do
41RIESGO
abrir ↗
Referência
CVE-2026-11965
CVE-2026-11965MEDIUM
User Registration & Membership < 5.2.0 - Unauthenticated Paid Membership Bypass
33RIESGO
abrir ↗
Referência
CVE-2026-120231
CVE-2026-120231CRITICAL
WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-120230
CVE-2026-120230CRITICAL
WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-14623
CVE-2026-14623MEDIUM
omec-project amf NGAP Message RRCInactiveTransitionReport denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-14621
CVE-2026-14621LOW
FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session
28RIESGO
abrir ↗
Referência
CVE-2026-11781
CVE-2026-11781LOW
Adminify < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAX
28RIESGO
abrir ↗
Referência
CVE-2026-120229
CVE-2026-120229CRITICAL
WAVLINK WN553X1-B ioos sub_416B50 os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-120228
CVE-2026-120228CRITICAL
WAVLINK WN553X1-B ioos Service sub_416D88 os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-112139
CVE-2026-112139MEDIUM
subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-100898
CVE-2026-100898MEDIUM
DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
F-PROT AntiVirus 6.2.1.4252 - Malformed Archive Infinite Loop Denial of Service
CVE-2008-3447—dosmultiple
The scanning engine in F-Prot Antivirus 6.2.1 4252 allows remote attackers to cause a denial of service (infinite loop)
23RIESGO
abrir ↗
Referência
CVE-2026-11578
CVE-2026-11578LOW
Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR
28RIESGO
abrir ↗
← anteriorpágina 841 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.