Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.449exploits catalogados

35.552CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.451Referência 22.367GitHub PoC 14.225VulnCheck XDB 8649Nuclei 4283Metasploit 3474✓ solo verificadosrecientes populares riesgo

22.332 exploits

Referência

CVE-2026-19074

CVE-2026-19074MEDIUM

Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-18786

CVE-2026-18786HIGH

CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass

41RIESGO

abrir ↗

Referência

CVE-2026-18200

CVE-2026-18200MEDIUM

FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update

33RIESGO

abrir ↗

Referência

CVE-2026-15047

CVE-2026-15047MEDIUM

s2Member < 260805 - Contributor+ Stored XSS via Shortcode

33RIESGO

abrir ↗

Referência

CVE-2026-14293

CVE-2026-14293HIGH

Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor

41RIESGO

abrir ↗

Referência

CVE-2026-14238

CVE-2026-14238MEDIUM

Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report

33RIESGO

abrir ↗

Referência

CVE-2026-14237

CVE-2026-14237HIGH

Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation

41RIESGO

abrir ↗

Referência

CVE-2026-14211

CVE-2026-14211LOW

Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

28RIESGO

abrir ↗

Referência

CVE-2026-17023

CVE-2026-17023MEDIUM

Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback

33RIESGO

abrir ↗

Referência

CVE-2026-17022

CVE-2026-17022HIGH

Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard

41RIESGO

abrir ↗

Referência

CVE-2026-17021

CVE-2026-17021MEDIUM

Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering

33RIESGO

abrir ↗

Referência

CVE-2026-17020

CVE-2026-17020MEDIUM

Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-15229

CVE-2026-15229MEDIUM

Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

33RIESGO

abrir ↗

Referência

CVE-2026-19053

CVE-2026-19053CRITICAL

ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter

48RIESGO

abrir ↗

Referência

CVE-2026-19049

CVE-2026-19049HIGH

ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie

41RIESGO

abrir ↗

Referência

CVE-2026-18960

CVE-2026-18960MEDIUM

Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords

33RIESGO

abrir ↗

Referência

CVE-2026-18946

CVE-2026-18946HIGH

Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename

41RIESGO

abrir ↗

Referência

CVE-2026-18934

CVE-2026-18934MEDIUM

RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion

33RIESGO

abrir ↗

Referência

CVE-2026-16985

CVE-2026-16985HIGH

Squeeze < 1.7.12 - Author+ Arbitrary File Upload

41RIESGO

abrir ↗

Referência

CVE-2026-16949

CVE-2026-16949MEDIUM

Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup

33RIESGO

abrir ↗

Referência

CVE-2026-16036

CVE-2026-16036HIGH

miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding

41RIESGO

abrir ↗

Referência

CVE-2026-15372

CVE-2026-15372HIGH

WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider

41RIESGO

abrir ↗

Referência

CVE-2026-16561

CVE-2026-16561HIGH

Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure

41RIESGO

abrir ↗

Referência

CVE-2026-18903

CVE-2026-18903MEDIUM

yeqifu warehouse FileController.java path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-18902

CVE-2026-18902HIGH

H3C NX15 esps repeaterproc command injection

41RIESGO

abrir ↗

Referência

CVE-2026-18901

CVE-2026-18901HIGH

H3C NX15 Web API esps service.add routine

41RIESGO

abrir ↗

Referência

CVE-2026-18819

CVE-2026-18819MEDIUM

RackTables cross-site request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-70619

CVE-2026-70619HIGH

Odysseus Missing Admin Authorization via Embedding Endpoint Routes

41RIESGO

abrir ↗

Referência

CVE-2026-70620

CVE-2026-70620MEDIUM

Odysseus SSRF via Embedding Endpoint Configuration

33RIESGO

abrir ↗

Referência

CVE-2026-18788

CVE-2026-18788MEDIUM

Trippo ResponsiveFilemanager dialog.php unrestricted upload

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.