Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2014-8469
CVE-2014-8469—
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attacker
23RIESGO
abrir ↗
Referência
CVE-2023-30198
CVE-2023-30198HIGH
Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download
41RIESGO
abrir ↗
Referência
CVE-2026-96556
CVE-2026-96556MEDIUM
Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization
33RIESGO
abrir ↗
Referência
CVE-2014-8826
CVE-2014-8826—
LaunchServices in Apple OS X before 10.10.2 does not properly handle file-type metadata, which allows attackers to bypas
23RIESGO
abrir ↗
Referência
Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection
CVE-2023-34635—webappsphp
Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not vali
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Kaqoo Auction - 'install_root' Multiple Remote File Inclusions
CVE-2007-1790—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Kaqoo Auction Software Free Edition allow remote attackers to exec
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Picture-Engine 1.2.0 - 'wall.php?cat' SQL Injection
CVE-2007-1791—webappsphp
SQL injection vulnerability in wall.php in Picture-Engine 1.2.0 and earlier allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2014-9173
CVE-2014-9173—
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote atta
23RIESGO
abrir ↗
Referência
CVE-2023-36346
CVE-2023-36346—
POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parame
38RIESGO
abrir ↗
Referência
CVE-2026-88929
CVE-2026-88929MEDIUM
Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-92541
CVE-2026-92541HIGH
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer
41RIESGO
abrir ↗
Referência
CVE-2026-92540
CVE-2026-92540HIGH
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users
41RIESGO
abrir ↗
Referência
Bolt CMS 3.6.4 - Cross-Site Scripting
CVE-2019-9553—webappsphp
Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and
23RIESGO
abrir ↗
Referência
CVE-2026-92423
CVE-2026-92423LOW
Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts
28RIESGO
abrir ↗
Referência
CVE-2026-94109
CVE-2026-94109HIGH
openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
41RIESGO
abrir ↗
Referência
CVE-2019-9581
CVE-2019-9581—
phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitra
28RIESGO
abrir ↗
Referência
CVE-2026-92965
CVE-2026-92965LOW
TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption
28RIESGO
abrir ↗
Referência
CVE-2014-9567
CVE-2014-9567—
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RIESGO
abrir ↗
Referência
CVE-2014-9567
CVE-2014-9567—
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RIESGO
abrir ↗
Referência
CVE-2026-94042
CVE-2026-94042MEDIUM
AdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-94041
CVE-2026-94041MEDIUM
AdithyaYelloju Restaurant-Management-System add_menu.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-94040
CVE-2026-94040MEDIUM
vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2014-9583
CVE-2014-9583—
common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC
60RIESGO
abrir ↗
Referência
CVE-2014-9612
CVE-2014-9612—
SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1
23RIESGO
abrir ↗
Referência
CVE-2026-94038
CVE-2026-94038MEDIUM
NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Free MP3 CD Ripper 2.6 - '.mp3' Buffer Overflow (SEH)
CVE-2019-9766—localwindows_x86
Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2026-94033
CVE-2026-94033MEDIUM
SourceCodester Drug Recommendation System User Management add_user cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-94032
CVE-2026-94032MEDIUM
itsourcecode Leave Management System index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-96882
CVE-2026-96882MEDIUM
TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-90849
CVE-2026-90849MEDIUM
SourceCodester College Notes Gallery Management System login.php sql injection
33RIESGO
abrir ↗
← anteriorpágina 853 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.