Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência✓ VexDay Proof
Barracuda Web Application Firewall - Authentication Bypass
CVE-2014-2595—remotehardware
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a perm
28RIESGO
abrir ↗
Referência
CVE-2026-108677
CVE-2026-108677HIGH
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName
41RIESGO
abrir ↗
Referência
CVE-2026-16619
CVE-2026-16619HIGH
miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts
41RIESGO
abrir ↗
Referência
CVE-2014-2598
CVE-2014-2598—
Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows
23RIESGO
abrir ↗
Referência
CVE-2014-2623
CVE-2014-2623—
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
60RIESGO
abrir ↗
Referência
CVE-2026-108673
CVE-2026-108673MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls
33RIESGO
abrir ↗
Referência
CVE-2019-13529
CVE-2019-13529HIGH
An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform action
41RIESGO
abrir ↗
Referência
CVE-2026-18995
CVE-2026-18995MEDIUM
netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-108664
CVE-2026-108664MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById
33RIESGO
abrir ↗
Referência
CVE-2026-15511
CVE-2026-15511CRITICAL
Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-16073
CVE-2026-16073MEDIUM
AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-62239
CVE-2026-62239MEDIUM
FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
33RIESGO
abrir ↗
Referência
CVE-2014-3120
CVE-2014-3120HIGHbajo ataque
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
100RIESGO
abrir ↗
Referência
CVE-2026-14800
CVE-2026-14800MEDIUM
imhamzaazam ecommerceFlask cross-site request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-6382
CVE-2026-6382CRITICAL
Multiple elFinder Plugins - Authenticated OS Command Injection
48RIESGO
abrir ↗
Referência
CVE-2018-7602
CVE-2018-7602HIGHbajo ataqueransomware
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
100RIESGO
abrir ↗
Referência
CVE-2019-14804
CVE-2019-14804—
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template
23RIESGO
abrir ↗
Referência
CVE-2026-15473
CVE-2026-15473MEDIUM
Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-14723
CVE-2026-14723MEDIUM
AD-Security AD_Miner Cache analyse_cache.py request_a deserialization
33RIESGO
abrir ↗
Referência
CVE-2026-15472
CVE-2026-15472MEDIUM
Eleveo Call Recording Software composeEmailAction.do improper authorization
33RIESGO
abrir ↗
Referência
CVE-2019-15081
CVE-2019-15081—
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing fe
23RIESGO
abrir ↗
Referência
CVE-2026-15515
CVE-2026-15515HIGH
Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path
41RIESGO
abrir ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHbajo ataque
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RIESGO
abrir ↗
Referência
CVE-2019-16759
CVE-2019-16759CRITICALbajo ataque
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RIESGO
abrir ↗
Referência
CVE-2019-17220
CVE-2019-17220—
Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.
23RIESGO
abrir ↗
Referência
CVE-2022-29885
CVE-2022-29885—
EncryptInterceptor does not provide complete protection on insecure networks
45RIESGO
abrir ↗
Referência
CVE-2026-18647
CVE-2026-18647MEDIUM
jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-72743
CVE-2026-72743MEDIUM
SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
33RIESGO
abrir ↗
Referência
CVE-2026-112021
CVE-2026-112021HIGH
snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()
41RIESGO
abrir ↗
Referência
CVE-2014-4716
CVE-2014-4716—
Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authenticatio
23RIESGO
abrir ↗
← anteriorpágina 854 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.