Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-83544
CVE-2026-83544MEDIUM
Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute
33RIESGO
abrir ↗
Referência
CVE-2026-66731
CVE-2026-66731HIGH
facil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
41RIESGO
abrir ↗
Referência
CVE-2026-109440
CVE-2026-109440HIGH
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
41RIESGO
abrir ↗
Referência
CVE-2026-113356
CVE-2026-113356HIGH
DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
41RIESGO
abrir ↗
Referência
CVE-2026-84887
CVE-2026-84887MEDIUM
simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
33RIESGO
abrir ↗
Referência
CVE-2021-43481
CVE-2021-43481—
An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstag
23RIESGO
abrir ↗
Referência
CVE-2024-6244
CVE-2024-6244HIGH
pz-frontend-manager < 1.0.6 - CSRF change user profile picture
41RIESGO
abrir ↗
Referência
CVE-2026-77004
CVE-2026-77004MEDIUM
Comfast CF-N1-S mbox-config sprintf command injection
33RIESGO
abrir ↗
Referência
CVE-2026-66730
CVE-2026-66730HIGH
facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser
41RIESGO
abrir ↗
Referência
CVE-2026-66729
CVE-2026-66729HIGH
facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
41RIESGO
abrir ↗
Referência
CVE-2026-82667
CVE-2026-82667MEDIUM
yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2020-10963
CVE-2020-10963—
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution)
28RIESGO
abrir ↗
Referência
CVE-2018-18776
CVE-2018-18776—
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (
23RIESGO
abrir ↗
Referência
CVE-2018-18776
CVE-2018-18776—
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (
23RIESGO
abrir ↗
Referência
CVE-2018-18777
CVE-2018-18777—
Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subp
43RIESGO
abrir ↗
Referência
CVE-2026-112101
CVE-2026-112101MEDIUM
BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
33RIESGO
abrir ↗
Referência
CVE-2026-13174
CVE-2026-13174HIGH
Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR
41RIESGO
abrir ↗
Referência
CVE-2026-19750
CVE-2026-19750CRITICAL
Tenda CH/CP/TX3 SSH hard-coded password
48RIESGO
abrir ↗
Referência
CVE-2026-15388
CVE-2026-15388MEDIUM
Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure
33RIESGO
abrir ↗
Referência
CVE-2018-18857
CVE-2018-18857—
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RIESGO
abrir ↗
Referência
CVE-2026-110981
CVE-2026-110981HIGH
WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-74922
CVE-2026-74922MEDIUM
Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
33RIESGO
abrir ↗
Referência
CVE-2026-74921
CVE-2026-74921MEDIUM
Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes
33RIESGO
abrir ↗
Referência
CVE-2026-11338
CVE-2026-11338MEDIUM
SourceCodester Ship Ferry Ticket Reservation System manage_user cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-91047
CVE-2026-91047MEDIUM
ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-11437
CVE-2026-11437MEDIUM
perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-11436
CVE-2026-11436MEDIUM
Mage AI Sign-in Flow index.tsx useMutation cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-110976
CVE-2026-110976MEDIUM
AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media
33RIESGO
abrir ↗
Referência
CVE-2026-18789
CVE-2026-18789HIGH
Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes
41RIESGO
abrir ↗
Referência
CVE-2026-97314
CVE-2026-97314MEDIUM
ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection
33RIESGO
abrir ↗
← anteriorpágina 843 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.