Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-118407
CVE-2026-118407MEDIUM
Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
33RIESGO
abrir ↗
Referência
CVE-2026-118404
CVE-2026-118404MEDIUM
Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-118403
CVE-2026-118403LOW
Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure
28RIESGO
abrir ↗
Referência
CVE-2026-115426
CVE-2026-115426MEDIUM
WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting
33RIESGO
abrir ↗
Referência
CVE-2026-115262
CVE-2026-115262MEDIUM
Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore
33RIESGO
abrir ↗
Referência
CVE-2026-115257
CVE-2026-115257MEDIUM
WP Roster < 2.36 - Unauthenticated Roster Data Modification
33RIESGO
abrir ↗
Referência
CVE-2026-115250
CVE-2026-115250MEDIUM
Text Typing < 2.2.2 - Contributor+ Stored XSS
33RIESGO
abrir ↗
Referência
CVE-2026-115243
CVE-2026-115243MEDIUM
WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files
33RIESGO
abrir ↗
Referência
CVE-2026-115242
CVE-2026-115242MEDIUM
WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path
33RIESGO
abrir ↗
Referência
CVE-2026-115241
CVE-2026-115241MEDIUM
WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID
33RIESGO
abrir ↗
Referência
CVE-2026-114431
CVE-2026-114431MEDIUM
Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload
33RIESGO
abrir ↗
Referência
CVE-2026-112244
CVE-2026-112244MEDIUM
Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points
33RIESGO
abrir ↗
Referência
CVE-2026-112243
CVE-2026-112243MEDIUM
Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-111962
CVE-2026-111962LOW
WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File
28RIESGO
abrir ↗
Referência
CVE-2026-111740
CVE-2026-111740LOW
Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure
28RIESGO
abrir ↗
Referência
CVE-2026-110964
CVE-2026-110964MEDIUM
Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-110692
CVE-2026-110692MEDIUM
PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import
33RIESGO
abrir ↗
Referência
CVE-2026-88849
CVE-2026-88849LOW
MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment
28RIESGO
abrir ↗
Referência
CVE-2026-101165
CVE-2026-101165LOW
Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay
28RIESGO
abrir ↗
Referência
CVE-2026-121617
CVE-2026-121617HIGH
Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds write
41RIESGO
abrir ↗
Referência
CVE-2026-121616
CVE-2026-121616MEDIUM
Linksys E5600 JSON Request mesh_login.cgi strcpy out-of-bounds write
33RIESGO
abrir ↗
Referência
CVE-2026-121615
CVE-2026-121615CRITICAL
Linksys E5600 Login mesh_login.cgi improper authentication
48RIESGO
abrir ↗
Referência
CVE-2026-121610
CVE-2026-121610MEDIUM
funadmin Frontend List Endpoint index selectList sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-121609
CVE-2026-121609CRITICAL
Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials
48RIESGO
abrir ↗
Referência
CVE-2026-121608
CVE-2026-121608MEDIUM
Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-78392
CVE-2026-78392MEDIUM
Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-111972
CVE-2026-111972MEDIUM
Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-111958
CVE-2026-111958HIGH
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
41RIESGO
abrir ↗
Referência
CVE-2026-110011
CVE-2026-110011LOW
MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export
28RIESGO
abrir ↗
Referência
CVE-2026-109931
CVE-2026-109931LOW
Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
28RIESGO
abrir ↗
← anteriorpágina 872 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.