Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-116620
CVE-2026-116620MEDIUM
Tencent RapidJSON Regex stream.h Take out-of-bounds
33RIESGO
abrir ↗
Referência
CVE-2026-63771
CVE-2026-63771MEDIUM
Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
33RIESGO
abrir ↗
Referência
CVE-2020-25557
CVE-2020-25557—
In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. A
23RIESGO
abrir ↗
Referência
CVE-2026-82422
CVE-2026-82422MEDIUM
itsourcecode Sales and Inventory System emp_del.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-17522
CVE-2026-17522MEDIUM
Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF
33RIESGO
abrir ↗
Referência
CVE-2026-16947
CVE-2026-16947CRITICAL
Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure
48RIESGO
abrir ↗
Referência
CVE-2026-109827
CVE-2026-109827MEDIUM
GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write
33RIESGO
abrir ↗
Referência
CVE-2026-116603
CVE-2026-116603MEDIUM
SourceCodester Online Food Ordering System add_food.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-116602
CVE-2026-116602MEDIUM
SourceCodester Online Food Ordering System delete.php unlink path traversal
33RIESGO
abrir ↗
Referência
CVE-2018-19862
CVE-2018-19862—
Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST re
28RIESGO
abrir ↗
Referência
CVE-2026-116556
CVE-2026-116556MEDIUM
Argilla TextField.vue cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-109607
CVE-2026-109607MEDIUM
SourceCodester Online Exam System Login Endpoint loginExe.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-109524
CVE-2026-109524MEDIUM
girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
33RIESGO
abrir ↗
Referência
CVE-2026-109966
CVE-2026-109966MEDIUM
yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method
33RIESGO
abrir ↗
Referência
Titan FTP Server Version 2019 Build 3505 - Directory Traversal / Local File Inclusion
CVE-2019-10009—webappswindows
A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated use
28RIESGO
abrir ↗
Referência
CVE-2026-108973
CVE-2026-108973MEDIUM
SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-73506
CVE-2026-73506MEDIUM
Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
33RIESGO
abrir ↗
Referência
CVE-2026-18046
CVE-2026-18046MEDIUM
Cookie Consent < 0.0.10 - Subscriber+ MaxMind License Key Update
33RIESGO
abrir ↗
Referência
CVE-2013-5578
CVE-2013-5578—
Buffer overflow in the ToDot method in the WINGRAPHVIZLib.NEATO ActiveX control in WinGraphviz.dll in StarUML allows rem
23RIESGO
abrir ↗
Referência
CentOS Web Panel 0.9.8.789 - NameServer Field Persistent Cross-Site Scripting
CVE-2019-10261—webappslinux
CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fiel
23RIESGO
abrir ↗
Referência
CVE-2026-40522
CVE-2026-40522HIGH
FrontAccounting < 2.4.20 SQL Injection via rep601.php
41RIESGO
abrir ↗
Referência
CVE-2019-10267
CVE-2019-10267—
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to
60RIESGO
abrir ↗
Referência
CVE-2026-13510
CVE-2026-13510MEDIUM
SimStudioAI sim Password Protection deployment.ts weak hash
33RIESGO
abrir ↗
Referência
CVE-2026-13509
CVE-2026-13509MEDIUM
RAGapp Knowledge File files.py FileHandler.remove_file path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-13508
CVE-2026-13508MEDIUM
khoj-ai khoj Conversation Sharing api_chat.py authorization
33RIESGO
abrir ↗
Referência
CVE-2026-13504
CVE-2026-13504MEDIUM
code-projects Project Management System Mail Compose mail.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-13496
CVE-2026-13496MEDIUM
itsourcecode Hospital Management System ajaxmedicine.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-13581
CVE-2026-13581MEDIUM
Edimax EW-7478APC POST Request formStaDrvSetup os command injection
33RIESGO
abrir ↗
Referência
CVE-2013-5978
CVE-2013-5978—
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPr
23RIESGO
abrir ↗
Referência
CVE-2026-103300
CVE-2026-103300MEDIUM
Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback
33RIESGO
abrir ↗
← anteriorpágina 845 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.