Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-77226
CVE-2026-77226CRITICAL
Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint
48RIESGO
abrir ↗
Referência
CVE-2026-105232
CVE-2026-105232MEDIUM
kishor-23 food-waste-management-system Registration deliverysignup.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-105231
CVE-2026-105231MEDIUM
kishor-23 food-waste-management-system Admin Registration signup.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-105226
CVE-2026-105226MEDIUM
osCommerce osCommerce2 Newsletter Management newsletters.php include code injection
33RIESGO
abrir ↗
Referência
CVE-2026-105184
CVE-2026-105184MEDIUM
itsourcecode Online Admission System creteria.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2016-2345
CVE-2016-2345—
Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows rem
35RIESGO
abrir ↗
Referência
CVE-2016-2388
CVE-2016-2388MEDIUMbajo ataque
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor
75RIESGO
abrir ↗
Referência
CVE-2020-9496
CVE-2020-9496—
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
60RIESGO
abrir ↗
Referência
CVE-2026-105392
CVE-2026-105392MEDIUM
Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key
33RIESGO
abrir ↗
Referência
CVE-2026-105386
CVE-2026-105386MEDIUM
onetwothreeneth HospitalManagementSystem print.php get sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-104973
CVE-2026-104973HIGH
Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
41RIESGO
abrir ↗
Referência
CVE-2026-105183
CVE-2026-105183MEDIUM
itsourcecode Online Admission System confirm.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-105182
CVE-2026-105182MEDIUM
SourceCodester Online Reviewer Management System btn_functions.php update sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-84066
CVE-2026-84066LOW
Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
28RIESGO
abrir ↗
Referência
CVE-2026-109444
CVE-2026-109444CRITICAL
OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection
48RIESGO
abrir ↗
Referência
CVE-2026-109443
CVE-2026-109443HIGH
JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell
41RIESGO
abrir ↗
Referência
CVE-2016-3357
CVE-2016-3357—
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 20
35RIESGO
abrir ↗
Referência
CVE-2026-112372
CVE-2026-112372MEDIUM
H3C Magic NX15 upload importprofile path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-82194
CVE-2026-82194MEDIUM
WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path Traversal
33RIESGO
abrir ↗
Referência✓ VexDay Proof
WzdFTPD 0.8.0 - 'USER' Remote Denial of Service
CVE-2007-5300—doswindows
Off-by-one error in the do_login_loop function in libwzd-core/wzd_login.c in wzdftpd 0.8.0, 0.8.2, and possibly other ve
23RIESGO
abrir ↗
Referência
CVE-2026-96903
CVE-2026-96903MEDIUM
Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers
33RIESGO
abrir ↗
Referência
CVE-2016-3714
CVE-2016-3714HIGHbajo ataque
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
100RIESGO
abrir ↗
Referência
CVE-2016-3714
CVE-2016-3714HIGHbajo ataque
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Firefly Media Server 0.2.4 - Remote Denial of Service
CVE-2007-5824—doslinux
webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (
23RIESGO
abrir ↗
Referência
CVE-2026-4523
CVE-2026-4523LOW
Missing Authorization in GitLab
28RIESGO
abrir ↗
Referência
CVE-2026-15217
CVE-2026-15217HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RIESGO
abrir ↗
Referência
CVE-2026-19889
CVE-2026-19889HIGH
Server-Side Request Forgery (SSRF) in GitLab AI Gateway
41RIESGO
abrir ↗
Referência
CVE-2026-77017
CVE-2026-77017HIGH
Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment
41RIESGO
abrir ↗
Referência
CVE-2026-19919
CVE-2026-19919MEDIUM
code-projects Online Shopping System Login login.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-78170
CVE-2026-78170HIGH
UTT HiPER 1200GW formConfigFastDirectionW strcpy buffer overflow
41RIESGO
abrir ↗
← anteriorpágina 861 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.