Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-94038
CVE-2026-94038MEDIUM
NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Free MP3 CD Ripper 2.6 - '.mp3' Buffer Overflow (SEH)
CVE-2019-9766—localwindows_x86
Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2026-94033
CVE-2026-94033MEDIUM
SourceCodester Drug Recommendation System User Management add_user cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-94032
CVE-2026-94032MEDIUM
itsourcecode Leave Management System index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-90695
CVE-2026-90695MEDIUM
SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-81648
CVE-2026-81648CRITICAL
CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
48RIESGO
abrir ↗
Referência
CVE-2026-95830
CVE-2026-95830MEDIUM
theRealSain Pixtream post_upload.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-90952
CVE-2026-90952MEDIUM
WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API
33RIESGO
abrir ↗
Referência
CVE-2026-90829
CVE-2026-90829MEDIUM
GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference
33RIESGO
abrir ↗
Referência
CVE-2026-97317
CVE-2026-97317MEDIUM
Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page
33RIESGO
abrir ↗
Referência
CVE-2026-90939
CVE-2026-90939HIGH
novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint
41RIESGO
abrir ↗
Referência
CVE-2026-95273
CVE-2026-95273MEDIUM
dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-90784
CVE-2026-90784MEDIUM
Dvidelabs flatcc semantics.c fb_clear_parser memory leak
33RIESGO
abrir ↗
Referência
CVE-2026-88764
CVE-2026-88764MEDIUM
Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref
33RIESGO
abrir ↗
Referência
CVE-2026-95272
CVE-2026-95272MEDIUM
dgtlmoon changedetection.io Screenshot flask_app.py static_content path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-90807
CVE-2026-90807MEDIUM
nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following
33RIESGO
abrir ↗
Referência
CVE-2026-86407
CVE-2026-86407LOW
User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page
28RIESGO
abrir ↗
Referência
CVE-2026-102845
CVE-2026-102845MEDIUM
gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-82807
CVE-2026-82807CRITICAL
ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management
48RIESGO
abrir ↗
Referência
CVE-2026-14307
CVE-2026-14307HIGH
Geotargeting WP < 3.5.6.2 - Reflected XSS
41RIESGO
abrir ↗
Referência
CVE-2015-1187
CVE-2015-1187CRITICALbajo ataque
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr
100RIESGO
abrir ↗
Referência
CVE-2015-1187
CVE-2015-1187CRITICALbajo ataque
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr
100RIESGO
abrir ↗
Referência
CVE-2015-1318
CVE-2015-1318—
The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a craf
38RIESGO
abrir ↗
Referência
CVE-2026-9830
CVE-2026-9830HIGH
BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug
41RIESGO
abrir ↗
Referência
CVE-2015-1325
CVE-2015-1325—
Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ub
23RIESGO
abrir ↗
Referência
CVE-2026-78137
CVE-2026-78137HIGH
StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart
41RIESGO
abrir ↗
Referência
CVE-2026-78125
CVE-2026-78125MEDIUM
LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-102804
CVE-2026-102804MEDIUM
Nothings stb stb_hexwave.h hexwave_init integer overflow
33RIESGO
abrir ↗
Referência
CVE-2026-82802
CVE-2026-82802MEDIUM
NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-82664
CVE-2026-82664MEDIUM
yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting
33RIESGO
abrir ↗
← anteriorpágina 858 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.