Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.449exploits catalogados

35.552CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.451Referência 22.367GitHub PoC 14.225VulnCheck XDB 8649Nuclei 4283Metasploit 3474✓ solo verificadosrecientes populares riesgo

22.332 exploits

Referência

CVE-2026-73030

CVE-2026-73030HIGH

unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape

41RIESGO

abrir ↗

Referência

CVE-2026-72743

CVE-2026-72743MEDIUM

SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html

33RIESGO

abrir ↗

Referência

CVE-2026-69118

CVE-2026-69118HIGH

Cachet 2.4.1 Authenticated Server-Side Template Injection RCE

41RIESGO

abrir ↗

Referência

CVE-2026-9632

CVE-2026-9632HIGH

UTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-15238

CVE-2026-15238MEDIUM

Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-15237

CVE-2026-15237MEDIUM

Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

33RIESGO

abrir ↗

Referência

CVE-2026-14941

CVE-2026-14941MEDIUM

Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

33RIESGO

abrir ↗

Referência

CVE-2026-14860

CVE-2026-14860MEDIUM

Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery

33RIESGO

abrir ↗

Referência

CVE-2026-14206

CVE-2026-14206HIGH

HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure

41RIESGO

abrir ↗

Referência

CVE-2026-13701

CVE-2026-13701MEDIUM

Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting

33RIESGO

abrir ↗

Referência

CVE-2026-13600

CVE-2026-13600HIGH

AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron

41RIESGO

abrir ↗

Referência

CVE-2026-13170

CVE-2026-13170HIGH

Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting

41RIESGO

abrir ↗

Referência

CVE-2026-12971

CVE-2026-12971LOW

LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

28RIESGO

abrir ↗

Referência

CVE-2026-17018

CVE-2026-17018MEDIUM

CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR

33RIESGO

abrir ↗

Referência

CVE-2026-17010

CVE-2026-17010MEDIUM

Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta

33RIESGO

abrir ↗

Referência

CVE-2026-17016

CVE-2026-17016LOW

Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment

28RIESGO

abrir ↗

Referência

CVE-2026-17012

CVE-2026-17012MEDIUM

Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_email

33RIESGO

abrir ↗

Referência

CVE-2026-18666

CVE-2026-18666MEDIUM

Library Management System < 3.6.7 - Subscriber+ SQL Injection via Filter Value

33RIESGO

abrir ↗

Referência

CVE-2019-2000

CVE-2019-2000—

In several functions of binder.c, there is possible memory corruption due to a use after free. This could lead to local

23RIESGO

abrir ↗

Referência

CVE-2019-20085

CVE-2019-20085HIGHbajo ataque

TVT NVMS-1000 devices allow GET /.. Directory Traversal

100RIESGO

abrir ↗

Referência

CVE-2019-20085

CVE-2019-20085HIGHbajo ataque

TVT NVMS-1000 devices allow GET /.. Directory Traversal

100RIESGO

abrir ↗

Referência

CVE-2026-9478

CVE-2026-9478CRITICAL

Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection

48RIESGO

abrir ↗

Referência

D-Link DWL-2600AP - Multiple OS Command Injection

CVE-2019-20499—webappshardware

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Config

60RIESGO

abrir ↗

Referência

CVE-2026-19376

CVE-2026-19376MEDIUM

Uasoft Badaso File API api.php class permission

33RIESGO

abrir ↗

Referência

CVE-2026-19375

CVE-2026-19375MEDIUM

dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-19353

CVE-2026-19353LOW

DedeCMS Installation Wizard index.php _4_Setup file inclusion

28RIESGO

abrir ↗

Referência

CVE-2026-9428

CVE-2026-9428HIGH

Tenda F1202 PPTPUserSetting fromPPTPUserSetting stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2019-2725

CVE-2019-2725HIGHbajo ataqueransomware

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte

100RIESGO

abrir ↗

Referência

CVE-2018-25350

CVE-2018-25350CRITICAL

userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php

48RIESGO

abrir ↗

Referência

CVE-2018-25340

CVE-2018-25340HIGH

Smartshop 1 SQL Injection via category.php

41RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.