Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-84028
CVE-2026-84028MEDIUM
Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings
33RIESGO
abrir ↗
Referência
CVE-2026-93580
CVE-2026-93580MEDIUM
InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
33RIESGO
abrir ↗
Referência
CVE-2026-101008
CVE-2026-101008CRITICAL
aaPanel BaoTa File Merge files.py merge_split_file command injection
48RIESGO
abrir ↗
Referência
CVE-2026-101007
CVE-2026-101007CRITICAL
aaPanel BaoTa Database Backup database.py InputSql os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-89003
CVE-2026-89003MEDIUM
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview
33RIESGO
abrir ↗
Referência
CVE-2026-16574
CVE-2026-16574MEDIUM
Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-16563
CVE-2026-16563MEDIUM
Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-82695
CVE-2026-82695CRITICAL
Tenda AC18 Telnet telnet missing authentication
48RIESGO
abrir ↗
Referência
Online Magazine Management System 1.0 - SQLi Authentication Bypass
CVE-2021-44653—webappsphp
Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. The Admin panel auth
23RIESGO
abrir ↗
Referência
Online Pre-owned/Used Car Showroom Management System 1.0 - SQLi Authentication Bypass
CVE-2021-44655—webappsphp
Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. A
23RIESGO
abrir ↗
Referência
CVE-2026-16559
CVE-2026-16559MEDIUM
YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload
33RIESGO
abrir ↗
Referência
CVE-2021-44665
CVE-2021-44665—
A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when downloading a project file via
23RIESGO
abrir ↗
Referência
CVE-2026-16558
CVE-2026-16558MEDIUM
YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema
33RIESGO
abrir ↗
Referência
CVE-2026-16535
CVE-2026-16535MEDIUM
Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel
48RIESGO
abrir ↗
Referência
CVE-2026-84899
CVE-2026-84899MEDIUM
VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix
33RIESGO
abrir ↗
Referência
CVE-2026-16282
CVE-2026-16282MEDIUM
Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-84898
CVE-2026-84898MEDIUM
Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
33RIESGO
abrir ↗
Referência
CVE-2026-84022
CVE-2026-84022MEDIUM
Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes
33RIESGO
abrir ↗
Referência
CVE-2026-94216
CVE-2026-94216MEDIUM
ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting
33RIESGO
abrir ↗
Referência
CVE-2026-19722
CVE-2026-19722MEDIUM
WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore
33RIESGO
abrir ↗
Referência
CVE-2026-78333
CVE-2026-78333HIGH
12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
41RIESGO
abrir ↗
Referência
CVE-2026-12976
CVE-2026-12976MEDIUM
LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant
33RIESGO
abrir ↗
Referência
CVE-2026-88788
CVE-2026-88788MEDIUM
Text Styler <= 1.1.1 - Contributor+ Stored XSS
33RIESGO
abrir ↗
Referência
CVE-2026-94492
CVE-2026-94492MEDIUM
Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14334
CVE-2026-14334HIGH
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload
41RIESGO
abrir ↗
Referência
CVE-2026-77525
CVE-2026-77525MEDIUM
MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id
33RIESGO
abrir ↗
Referência
CVE-2026-94214
CVE-2026-94214MEDIUM
ST Engineering iDirect iDX/Evo iDX Location Header redirect
33RIESGO
abrir ↗
Referência
CVE-2026-94103
CVE-2026-94103MEDIUM
RooCMS Frontend Rendering site_pagePHP.php eval code injection
33RIESGO
abrir ↗
Referência
CVE-2026-94098
CVE-2026-94098CRITICAL
Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
48RIESGO
abrir ↗
Referência
CVE-2026-11565
CVE-2026-11565HIGH
Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui
56RIESGO
abrir ↗
← anteriorpágina 870 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.