Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
4478 exploits
Nucleimedium
Essential Blocks < 6.4.0 - Information Disclosure
CVE-2026-13153HIGH
Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint
56RIESGO
abrir ↗
Nucleicritical
Ivanti EPMM < 12.8.0.0 - Remote Code Execution
CVE-2026-1340CRITICALbajo ataque
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
100RIESGO
abrir ↗
Nucleicritical
WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload
CVE-2026-1357CRITICAL
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
75RIESGO
abrir ↗
Nucleihigh
Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation
CVE-2026-1368HIGH
Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation
36RIESGO
abrir ↗
Nucleihigh
WPBot <= 8.4.9 - Cross-Site Scripting
CVE-2026-13731HIGH
WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
36RIESGO
abrir ↗
Nucleicritical
WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
CVE-2026-1405CRITICAL
Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗
Nucleicritical
Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload
CVE-2026-14483CRITICAL
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command
63RIESGO
abrir ↗
Nucleicritical
WordPress Super Forms <= 6.3.313 - Arbitrary File Upload
CVE-2026-14894CRITICAL
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
63RIESGO
abrir ↗
Nucleicritical
WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation
CVE-2026-1492CRITICAL
User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration
68RIESGO
abrir ↗
Nucleimedium
WP Hotel Booking <= 2.3.2 - Cross-Site Scripting
CVE-2026-15094MEDIUM
WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter
28RIESGO
abrir ↗
Nucleihigh
WP Responsive Images <= 1.0 - Arbitrary File Read
CVE-2026-1557HIGH
WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src
36RIESGO
abrir ↗
Nucleicritical
WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read
CVE-2026-15733CRITICAL
WGDashboard Remote Code Execution vulnerability
48RIESGO
abrir ↗
Nucleicritical
wpForo Forum <= 2.4.14 - SQL Injection
CVE-2026-1581HIGH
wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
56RIESGO
abrir ↗
Nucleicritical
User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass
CVE-2026-15826CRITICAL
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
63RIESGO
abrir ↗
Nucleihigh
Ivanti Endpoint Manager - Authentication Bypass
CVE-2026-1603HIGHbajo ataque
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to
88RIESGO
abrir ↗
Nucleimedium
Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler
CVE-2026-16268HIGH
Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler
56RIESGO
abrir ↗
Nucleimedium
WordPress TranslatePress < 3.2.6 - Cross-Site Scripting
CVE-2026-17505MEDIUM
TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
28RIESGO
abrir ↗
Nucleimedium
Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting
CVE-2026-17532MEDIUM
Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting
48RIESGO
abrir ↗
Nucleihigh
Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch
CVE-2026-17594HIGH
Nexus Repository 3 - Authorization Bypass in Repository Creation
36RIESGO
abrir ↗
Nucleicritical
Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass
CVE-2026-18072CRITICAL
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter
43RIESGO
abrir ↗
Nucleicritical
Request Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload
CVE-2026-18143CRITICAL
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
63RIESGO
abrir ↗
Nucleicritical
Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload
CVE-2026-1830CRITICAL
Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗
Nucleicritical
N-able N-central < 2026.3.1.10 - Authentication Bypass
CVE-2026-18577HIGHbajo ataque
Incomplete patch leads to administrative account takeover
91RIESGO
abrir ↗
Nucleimedium
LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write
CVE-2026-1890MEDIUM
LeadConnector < 3.0.22 - Unauthenticated Rest Call
28RIESGO
abrir ↗
Nucleicritical
Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass
CVE-2026-18963CRITICAL
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RIESGO
abrir ↗
Nucleicritical
Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation
CVE-2026-19092CRITICAL
Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
63RIESGO
abrir ↗
Nucleicritical
GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation
CVE-2026-19478CRITICAL
Improper Control of Generation of Code ('Code Injection') in GitLab
75RIESGO
abrir ↗
Nucleicritical
Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router
CVE-2026-19598CRITICAL
Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router
63RIESGO
abrir ↗
Nucleicritical
TranslatePress <= 3.3.1 - Unauthenticated Account Takeover
CVE-2026-19632CRITICAL
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
63RIESGO
abrir ↗
Nucleimedium
WPBookit <= 1.0.8 - Unauthenticated Customer Information Disclosure
CVE-2026-1980MEDIUM
WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
28RIESGO
abrir ↗
← anteriorpágina 96 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.