Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.449exploits catalogados
35.552CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.451Referência 22.367GitHub PoC 14.225VulnCheck XDB 8649Nuclei 4283Metasploit 3474✓ solo verificadosrecientespopularesriesgo
22.301 exploits
Referência
MCL-Net 4.3.5.8788 - Information Disclosure
CVE-2023-34834—webappshardware
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attacker
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ashNews 0.83 - 'pathtoashnews' Remote File Inclusion
CVE-2003-1292—webappsphp
PHP remote file include vulnerability in Derek Ashauer ashNews 0.83 allows remote attackers to include and execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Eznet 3.5.0 - Remote Stack Overflow / Denial of Service
CVE-2003-1339—remotewindows
Stack-based buffer overflow in eZnet.exe, as used in eZ (a) eZphotoshare, (b) eZmeeting, (c) eZnetwork, and (d) eZshare
35RIESGO
abrir ↗
Referência
CVE-2026-14574
CVE-2026-14574MEDIUM
In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` rec
33RIESGO
abrir ↗
Referência
CVE-2026-19006
CVE-2026-19006MEDIUM
mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization
33RIESGO
abrir ↗
Referência
CVE-2026-67623
CVE-2026-67623HIGH
Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook
41RIESGO
abrir ↗
Referência
CVE-2026-67623
CVE-2026-67623HIGH
Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook
41RIESGO
abrir ↗
Referência
CVE-2026-66747
CVE-2026-66747CRITICAL
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
48RIESGO
abrir ↗
Referência
CVE-2026-17515
CVE-2026-17515MEDIUM
MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item
33RIESGO
abrir ↗
Referência
CVE-2026-16055
CVE-2026-16055HIGH
Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login
41RIESGO
abrir ↗
Referência
CVE-2026-18790
CVE-2026-18790MEDIUM
Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds
33RIESGO
abrir ↗
Referência
CVE-2026-16056
CVE-2026-16056MEDIUM
Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts
33RIESGO
abrir ↗
Referência
CVE-2026-16035
CVE-2026-16035MEDIUM
miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send
33RIESGO
abrir ↗
Referência
CVE-2026-15958
CVE-2026-15958CRITICAL
Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX
48RIESGO
abrir ↗
Referência
CVE-2026-15233
CVE-2026-15233MEDIUM
Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title
33RIESGO
abrir ↗
Referência
CVE-2026-14939
CVE-2026-14939MEDIUM
Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import
33RIESGO
abrir ↗
Referência
CVE-2026-14872
CVE-2026-14872MEDIUM
Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-14848
CVE-2026-14848MEDIUM
Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout
33RIESGO
abrir ↗
Referência
CVE-2026-14824
CVE-2026-14824MEDIUM
Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question
33RIESGO
abrir ↗
Referência
CVE-2026-14816
CVE-2026-14816MEDIUM
The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam
33RIESGO
abrir ↗
Referência
CVE-2026-12698
CVE-2026-12698MEDIUM
wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment
33RIESGO
abrir ↗
Referência
CVE-2026-11366
CVE-2026-11366LOW
MonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass
28RIESGO
abrir ↗
Referência
CVE-2026-10526
CVE-2026-10526MEDIUM
EmbedPress < 4.6.1 - Unauthenticated Blind SSRF
33RIESGO
abrir ↗
Referência
CVE-2026-16536
CVE-2026-16536MEDIUM
Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id
33RIESGO
abrir ↗
Referência
CVE-2026-16623
CVE-2026-16623HIGH
Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)
41RIESGO
abrir ↗
Referência
CVE-2026-16618
CVE-2026-16618CRITICAL
ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
48RIESGO
abrir ↗
Referência
CVE-2026-18723
CVE-2026-18723MEDIUM
diaowen DWSurvey Survey Status up-survey-status.do improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-18722
CVE-2026-18722MEDIUM
diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization
33RIESGO
abrir ↗
Referência
CVE-2026-18720
CVE-2026-18720MEDIUM
kalcaddle kodbox msgWarning Plugin action improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-18686
CVE-2026-18686CRITICAL
GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection
48RIESGO
abrir ↗
← anteriorpágina 474 / 744siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.