Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-107269
CVE-2026-107269MEDIUM
Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy
33RIESGO
abrir ↗
Referência
X.Org X Server 1.20.4 - Local Stack Overflow
CVE-2019-17624—locallinux
"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sendin
23RIESGO
abrir ↗
Referência
Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated)
CVE-2020-12261—webappsphp
Open-AudIT 3.3.0 allows an XSS attack after login.
23RIESGO
abrir ↗
Referência
CVE-2026-112037
CVE-2026-112037MEDIUM
diem-project diem Google Analytics Client gapi.class.php certificate validation
33RIESGO
abrir ↗
Referência
CVE-2026-112036
CVE-2026-112036MEDIUM
Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
33RIESGO
abrir ↗
Referência
CVE-2026-111986
CVE-2026-111986MEDIUM
AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection
33RIESGO
abrir ↗
Referência
CVE-2026-111985
CVE-2026-111985MEDIUM
AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources
33RIESGO
abrir ↗
Referência
CVE-2026-111984
CVE-2026-111984MEDIUM
AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-93528
CVE-2026-93528LOW
NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
28RIESGO
abrir ↗
Referência
CVE-2026-105921
CVE-2026-105921MEDIUM
Kusalkasilva Learning-Management-System search_class.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2014-5082
CVE-2014-5082—
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus al
23RIESGO
abrir ↗
Referência
CVE-2014-5084
CVE-2014-5084—
A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let
23RIESGO
abrir ↗
Referência
CVE-2019-19781
CVE-2019-19781CRITICALbajo ataqueransomware
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RIESGO
abrir ↗
Referência
CVE-2026-96514
CVE-2026-96514MEDIUM
Neethuharii CafeManagement Login CafePortalLogin.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-105316
CVE-2026-105316HIGH
Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions
41RIESGO
abrir ↗
Referência
CVE-2026-104049
CVE-2026-104049MEDIUM
Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-105918
CVE-2026-105918MEDIUM
Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection
33RIESGO
abrir ↗
Referência
CVE-2019-1999
CVE-2019-1999—
In binder_alloc_free_page of binder_alloc.c, there is a possible double free due to improper locking. This could lead to
23RIESGO
abrir ↗
Referência
CVE-2026-103681
CVE-2026-103681MEDIUM
Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete
33RIESGO
abrir ↗
Referência
CVE-2026-103378
CVE-2026-103378MEDIUM
Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File
33RIESGO
abrir ↗
Referência
CVE-2026-110715
CVE-2026-110715MEDIUM
MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort
33RIESGO
abrir ↗
Referência
CVE-2026-110669
CVE-2026-110669MEDIUM
cemtan sar2html sar2html.py deleteAll missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-110773
CVE-2026-110773MEDIUM
GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-110768
CVE-2026-110768MEDIUM
holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
33RIESGO
abrir ↗
Referência
CVE-2026-110764
CVE-2026-110764MEDIUM
AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download
33RIESGO
abrir ↗
Referência
CVE-2022-43769
CVE-2022-43769HIGHbajo ataque
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
100RIESGO
abrir ↗
Referência
CVE-2026-82844
CVE-2026-82844MEDIUM
WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce
33RIESGO
abrir ↗
Referência
CVE-2026-103308
CVE-2026-103308MEDIUM
Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-85345
CVE-2026-85345MEDIUM
FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data
33RIESGO
abrir ↗
Referência
CVE-2026-85000
CVE-2026-85000MEDIUM
EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating
33RIESGO
abrir ↗
← anteriorpágina 852 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.