Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-105977
CVE-2026-105977LOW
Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail
28RIESGO
abrir ↗
Referência
CVE-2026-85569
CVE-2026-85569HIGH
Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification
41RIESGO
abrir ↗
Referência
CVE-2026-108626
CVE-2026-108626MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-105989
CVE-2026-105989MEDIUM
Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery
33RIESGO
abrir ↗
Referência
CVE-2026-105976
CVE-2026-105976MEDIUM
Portfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions
33RIESGO
abrir ↗
Referência
CVE-2026-92764
CVE-2026-92764MEDIUM
OpenCVE 2.4.0 < 3.1.0 Organization API Ignores Token Scope
33RIESGO
abrir ↗
Referência
CVE-2026-85530
CVE-2026-85530HIGH
GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch
41RIESGO
abrir ↗
Referência
CVE-2026-85131
CVE-2026-85131MEDIUM
WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF
33RIESGO
abrir ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHbajo ataque
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RIESGO
abrir ↗
Referência
CVE-2014-6593
CVE-2014-6593—
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.
50RIESGO
abrir ↗
Referência
CVE-2019-4716
CVE-2019-4716CRITICALbajo ataque
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use
100RIESGO
abrir ↗
Referência
CVE-2021-46416
CVE-2021-46416MEDIUM
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups acce
33RIESGO
abrir ↗
Referência
CVE-2022-48197
CVE-2022-48197—
Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, Tree
38RIESGO
abrir ↗
Referência
CVE-2026-105173
CVE-2026-105173MEDIUM
code-projects Human Resource Management Event Creation EventStore.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-105166
CVE-2026-105166MEDIUM
kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection
33RIESGO
abrir ↗
Referência
CVE-2021-46417
CVE-2021-46417—
Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privilege
50RIESGO
abrir ↗
Referência
CVE-2021-46422
CVE-2021-46422—
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute
60RIESGO
abrir ↗
Referência
CVE-2026-104637
CVE-2026-104637MEDIUM
onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-104625
CVE-2026-104625MEDIUM
CodeAstro Simple Loan Management System index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-104609
CVE-2026-104609MEDIUM
onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-104606
CVE-2026-104606MEDIUM
itsourcecode Online Admission System Project confirm.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2021-46422
CVE-2021-46422—
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute
60RIESGO
abrir ↗
Referência
CVE-2019-5736
CVE-2019-5736—
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RIESGO
abrir ↗
Referência
CVE-2026-102373
CVE-2026-102373HIGH
GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-101054
CVE-2026-101054MEDIUM
Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control
33RIESGO
abrir ↗
Referência
CVE-2026-101053
CVE-2026-101053MEDIUM
Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control
33RIESGO
abrir ↗
Referência
CVE-2026-97650
CVE-2026-97650MEDIUM
ningzichun student-management-system addLog.php echo cross site scripting
33RIESGO
abrir ↗
Referência
GNU screen v4.9.0 - Privilege Escalation
CVE-2023-24626MEDIUMlocallinux
socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and F
33RIESGO
abrir ↗
Referência
CVE-2023-24788
CVE-2023-24788—
NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/s
23RIESGO
abrir ↗
Referência
CVE-2014-8577
CVE-2014-8577—
Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary we
23RIESGO
abrir ↗
← anteriorpágina 851 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.