Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência

CVE-2026-104053

CVE-2026-104053MEDIUM

itsourcecode Pet Shop Management System admin_reservefilter.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-104052

CVE-2026-104052MEDIUM

itsourcecode Pet Shop Management System admin_reject_completed.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-96255

CVE-2026-96255HIGH

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log

41RIESGO

abrir ↗

Referência

CVE-2026-81809

CVE-2026-81809HIGH

Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

41RIESGO

abrir ↗

Referência

CVE-2026-81739

CVE-2026-81739HIGH

Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

41RIESGO

abrir ↗

Referência

CVE-2026-85415

CVE-2026-85415MEDIUM

Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

33RIESGO

abrir ↗

Referência

CVE-2026-85001

CVE-2026-85001MEDIUM

EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute

33RIESGO

abrir ↗

Referência

CVE-2026-83560

CVE-2026-83560MEDIUM

New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass

33RIESGO

abrir ↗

Referência

CVE-2026-82127

CVE-2026-82127LOW

Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

28RIESGO

abrir ↗

Referência

CVE-2026-80333

CVE-2026-80333MEDIUM

Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes

33RIESGO

abrir ↗

Referência

CVE-2026-90706

CVE-2026-90706MEDIUM

D-Link DWR-M921 formWsc os command injection

33RIESGO

abrir ↗

Referência

CVE-2026-90705

CVE-2026-90705MEDIUM

D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection

33RIESGO

abrir ↗

Referência

CVE-2026-92399

CVE-2026-92399MEDIUM

GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow

33RIESGO

abrir ↗

Referência

CVE-2026-92364

CVE-2026-92364MEDIUM

itsourcecode Leave Management System index.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-89261

CVE-2026-89261MEDIUM

MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints

33RIESGO

abrir ↗

Referência

CVE-2026-86781

CVE-2026-86781MEDIUM

SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-19092

CVE-2026-19092CRITICAL

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

63RIESGO

abrir ↗

Referência

CVE-2026-76639

CVE-2026-76639HIGH

Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal

41RIESGO

abrir ↗

Referência

CVE-2026-90607

CVE-2026-90607CRITICAL

Totolink A3002MU boa formNewSchedule buffer overflow

48RIESGO

abrir ↗

Referência

CVE-2025-68624

CVE-2025-68624MEDIUM

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user

33RIESGO

abrir ↗

Referência

CVE-2026-84047

CVE-2026-84047HIGH

Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action

41RIESGO

abrir ↗

Referência

CVE-2026-80491

CVE-2026-80491HIGH

SAMO Forms <= 1.0.0 - Unauthenticated SQLi

41RIESGO

abrir ↗

Referência

CVE-2026-76549

CVE-2026-76549MEDIUM

UpdraftPlus < 1.26.7 - Backup Restoration via CSRF

33RIESGO

abrir ↗

Referência

CVE-2026-16568

CVE-2026-16568MEDIUM

ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-81491

CVE-2026-81491MEDIUM

boxpositron with-context-mcp index.ts project_folder path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-90604

CVE-2026-90604MEDIUM

Totolink A3002MU Anchor Tag cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-112045

CVE-2026-112045MEDIUM

donetick History Deletion model.go CanDeleteHistory improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-111872

CVE-2026-111872MEDIUM

itsmeravitejak Online-Examination-System database.php getreport sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-112091

CVE-2026-112091MEDIUM

Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-111871

CVE-2026-111871MEDIUM

itsmeravitejak Online-Examination-System subjectsdb.php sql injection

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.