Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência

CVE-2026-86510

CVE-2026-86510CRITICAL

D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write

48RIESGO

abrir ↗

Referência

CVE-2026-86509

CVE-2026-86509CRITICAL

D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow

48RIESGO

abrir ↗

Referência

CVE-2017-17626

CVE-2017-17626—

Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter.

23RIESGO

abrir ↗

Referência

CVE-2017-17628

CVE-2017-17628—

Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-94039

CVE-2026-94039MEDIUM

vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-86475

CVE-2026-86475MEDIUM

Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission

33RIESGO

abrir ↗

Referência

CVE-2017-17637

CVE-2017-17637—

Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-94036

CVE-2026-94036HIGH

D-Link DIR-X1860/DIR-X1860Z routerd ubus access control

41RIESGO

abrir ↗

Referência

CVE-2026-57147

CVE-2026-57147CRITICAL

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

48RIESGO

abrir ↗

Referência

CVE-2026-90517

CVE-2026-90517MEDIUM

PHPGurukul Bank Locker Management System view-assign-locker.php authorization

33RIESGO

abrir ↗

Referência

CVE-2026-82213

CVE-2026-82213MEDIUM

Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-93988

CVE-2026-93988HIGH

QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

41RIESGO

abrir ↗

Referência

CVE-2026-86812

CVE-2026-86812MEDIUM

WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API

33RIESGO

abrir ↗

Referência

CVE-2026-90516

CVE-2026-90516MEDIUM

SourceCodester School Registration and Fee System pay_report.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-86782

CVE-2026-86782MEDIUM

Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-84737

CVE-2026-84737CRITICAL

Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter

48RIESGO

abrir ↗

Referência

CVE-2026-90515

CVE-2026-90515MEDIUM

SourceCodester School Registration and Fee System delete_stud.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-90505

CVE-2026-90505LOW

vvbbnn00 WARP-Clash-API doUpdateLicenseKey race condition

28RIESGO

abrir ↗

Referência

CVE-2026-90498

CVE-2026-90498MEDIUM

lenve vhr vhr.sql default credentials

33RIESGO

abrir ↗

Referência

CVE-2026-90972

CVE-2026-90972MEDIUM

WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

33RIESGO

abrir ↗

Referência

CVE-2017-2456

CVE-2017-2456—

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS b

23RIESGO

abrir ↗

Referência

CVE-2026-86789

CVE-2026-86789MEDIUM

Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes

33RIESGO

abrir ↗

Referência

CVE-2026-75873

CVE-2026-75873CRITICAL

Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload

48RIESGO

abrir ↗

Referência

CVE-2026-102569

CVE-2026-102569HIGH

ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter

41RIESGO

abrir ↗

Referência

CVE-2026-102290

CVE-2026-102290MEDIUM

CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-101277

CVE-2026-101277MEDIUM

Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source

33RIESGO

abrir ↗

Referência

CVE-2026-101077

CVE-2026-101077CRITICAL

Netcore NR289-GE boa_temp process_request missing authentication

48RIESGO

abrir ↗

Referência

CVE-2026-88995

CVE-2026-88995MEDIUM

Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check

33RIESGO

abrir ↗

Referência

CVE-2026-89296

CVE-2026-89296HIGH

Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter

41RIESGO

abrir ↗

Referência

CVE-2026-88912

CVE-2026-88912MEDIUM

rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.