Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-84829
CVE-2026-84829HIGH
Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-85127
CVE-2026-85127HIGH
VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment
41RIESGO
abrir ↗
Referência
CVE-2026-85130
CVE-2026-85130HIGH
WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs
41RIESGO
abrir ↗
Referência
CVE-2015-0235
CVE-2015-0235—
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,
60RIESGO
abrir ↗
Referência
CVE-2015-0235
CVE-2015-0235—
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,
60RIESGO
abrir ↗
Referência✓ VexDay Proof
Quick and Dirty Blog (qdblog) 0.4 - SQL Injection / Local File Inclusion
CVE-2007-2304—webappsphp
Multiple directory traversal vulnerabilities in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote at
23RIESGO
abrir ↗
Referência
CVE-2026-85009
CVE-2026-85009MEDIUM
RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery
33RIESGO
abrir ↗
Referência
CVE-2026-84904
CVE-2026-84904LOW
King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer
28RIESGO
abrir ↗
Referência
CVE-2026-92466
CVE-2026-92466HIGH
microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
41RIESGO
abrir ↗
Referência
CVE-2026-92221
CVE-2026-92221MEDIUM
gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-102845
CVE-2026-102845MEDIUM
gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-82807
CVE-2026-82807CRITICAL
ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management
48RIESGO
abrir ↗
Referência
CVE-2026-14307
CVE-2026-14307HIGH
Geotargeting WP < 3.5.6.2 - Reflected XSS
41RIESGO
abrir ↗
Referência
CVE-2015-1187
CVE-2015-1187CRITICALbajo ataque
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr
100RIESGO
abrir ↗
Referência
CVE-2015-1187
CVE-2015-1187CRITICALbajo ataque
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr
100RIESGO
abrir ↗
Referência
CVE-2015-1318
CVE-2015-1318—
The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a craf
38RIESGO
abrir ↗
Referência
CVE-2026-9830
CVE-2026-9830HIGH
BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug
41RIESGO
abrir ↗
Referência
CVE-2015-1325
CVE-2015-1325—
Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ub
23RIESGO
abrir ↗
Referência
CVE-2026-78137
CVE-2026-78137HIGH
StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart
41RIESGO
abrir ↗
Referência
CVE-2026-78125
CVE-2026-78125MEDIUM
LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-102804
CVE-2026-102804MEDIUM
Nothings stb stb_hexwave.h hexwave_init integer overflow
33RIESGO
abrir ↗
Referência
CVE-2026-82802
CVE-2026-82802MEDIUM
NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-82664
CVE-2026-82664MEDIUM
yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Net_DNS 0.3 - '/DNS/RR.php' Remote File Inclusion
CVE-2006-5521—webappsphp
PHP remote file inclusion vulnerability in DNS/RR.php in Net_DNS 0.03 and earlier allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência
CVE-2026-94534
CVE-2026-94534HIGH
lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
41RIESGO
abrir ↗
Referência
CVE-2026-102362
CVE-2026-102362MEDIUM
mall4j through 4.0 Missing Authentication in Product Review Deletion
33RIESGO
abrir ↗
Referência
CVE-2026-14184
CVE-2026-14184MEDIUM
Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-14183
CVE-2026-14183MEDIUM
Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-95927
CVE-2026-95927MEDIUM
SourceCodester Online Reviewer Management System exam-delete.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-102361
CVE-2026-102361CRITICAL
mall4j through 4.0 Missing Authentication in Password Update Endpoint
48RIESGO
abrir ↗
← anteriorpágina 864 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.