Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2014-3704
CVE-2014-3704—
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗
Referência
CVE-2026-104079
CVE-2026-104079MEDIUM
Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-43642
CVE-2026-43642CRITICAL
Softaculous Virtualizor PHP Object Injection via Billing Module Handler
48RIESGO
abrir ↗
Referência
CVE-2019-16113
CVE-2019-16113—
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j
60RIESGO
abrir ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHbajo ataque
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RIESGO
abrir ↗
Referência
CVE-2019-16759
CVE-2019-16759CRITICALbajo ataque
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RIESGO
abrir ↗
Referência
CVE-2019-17220
CVE-2019-17220—
Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.
23RIESGO
abrir ↗
Referência
CVE-2022-29885
CVE-2022-29885—
EncryptInterceptor does not provide complete protection on insecure networks
45RIESGO
abrir ↗
Referência
CVE-2026-18647
CVE-2026-18647MEDIUM
jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-72743
CVE-2026-72743MEDIUM
SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
33RIESGO
abrir ↗
Referência
CVE-2026-112021
CVE-2026-112021HIGH
snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()
41RIESGO
abrir ↗
Referência
CVE-2014-4716
CVE-2014-4716—
Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authenticatio
23RIESGO
abrir ↗
Referência
CVE-2025-15673
CVE-2025-15673MEDIUM
Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read
33RIESGO
abrir ↗
Referência
CVE-2026-78202
CVE-2026-78202MEDIUM
itsourcecode Payroll System admin_class.php save_settings unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-86448
CVE-2026-86448LOW
LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order
28RIESGO
abrir ↗
Referência
CVE-2026-16299
CVE-2026-16299CRITICAL
Single Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password Reset
48RIESGO
abrir ↗
Referência
CVE-2026-86447
CVE-2026-86447MEDIUM
LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax
33RIESGO
abrir ↗
Referência
CVE-2026-90842
CVE-2026-90842MEDIUM
PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file
33RIESGO
abrir ↗
Referência
CVE-2026-85572
CVE-2026-85572MEDIUM
Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-18616
CVE-2026-18616CRITICAL
GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection
48RIESGO
abrir ↗
Referência
CVE-2025-15672
CVE-2025-15672HIGH
Chama < 1.0.13 - Unauthenticated PHP Object Injection
41RIESGO
abrir ↗
Referência
CVE-2026-90841
CVE-2026-90841MEDIUM
PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-90840
CVE-2026-90840MEDIUM
PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authentication
33RIESGO
abrir ↗
Referência
CVE-2026-93528
CVE-2026-93528LOW
NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
28RIESGO
abrir ↗
Referência
CVE-2026-105921
CVE-2026-105921MEDIUM
Kusalkasilva Learning-Management-System search_class.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2014-5082
CVE-2014-5082—
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus al
23RIESGO
abrir ↗
Referência
CVE-2014-5084
CVE-2014-5084—
A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let
23RIESGO
abrir ↗
Referência
CVE-2019-19781
CVE-2019-19781CRITICALbajo ataqueransomware
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RIESGO
abrir ↗
Referência
CVE-2026-96514
CVE-2026-96514MEDIUM
Neethuharii CafeManagement Login CafePortalLogin.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-105316
CVE-2026-105316HIGH
Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions
41RIESGO
abrir ↗
← anteriorpágina 850 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.