Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.533exploits catalogados

35.607CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.455Referência 22.407GitHub PoC 14.247VulnCheck XDB 8663Nuclei 4287Metasploit 3474✓ solo verificadosrecientes populares riesgo

22.367 exploits

Referência

CVE-2021-4034

CVE-2021-4034HIGHbajo ataqueransomware

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

abrir ↗

Referência

CVE-2021-4034

CVE-2021-4034HIGHbajo ataqueransomware

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

abrir ↗

Referência★ 40

crixpwn/CVE-2026-8389

CVE-2026-8389HIGH

JIT miscompilation in the JavaScript Engine: JIT component

41RIESGO

abrir ↗

Referência

CVE-2022-50965

CVE-2022-50965MEDIUM

uBidAuction 2.0.1 posts manage Reflected XSS

33RIESGO

abrir ↗

Referência

CVE-2022-50965

CVE-2022-50965MEDIUM

uBidAuction 2.0.1 posts manage Reflected XSS

33RIESGO

abrir ↗

Referência

CVE-2026-8138

CVE-2026-8138HIGH

Tenda CX12L SetPptpServerCfg” formSetPPTPServer stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-8137

CVE-2026-8137HIGH

Totolink X5000R formDdns sub_458E40 buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2026-8136

CVE-2026-8136MEDIUM

SourceCodester Pharmacy Sales and Inventory System index.php users cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-8133

CVE-2026-8133MEDIUM

zyx0814 FilePress Shares Filelist API admin.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-8132

CVE-2026-8132MEDIUM

CodeAstro Leave Management System login.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-8131

CVE-2026-8131MEDIUM

SourceCodester SUP Online Shopping replymsg.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2024-27686

CVE-2024-27686HIGH

Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (devic

41RIESGO

abrir ↗

Referência

CVE-2026-14231

CVE-2026-14231MEDIUM

LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts

33RIESGO

abrir ↗

Referência

CVE-2026-14207

CVE-2026-14207MEDIUM

LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information

33RIESGO

abrir ↗

Referência

Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure

CVE-2021-39327MEDIUMwebappsphp

BulletProof Security <= 5.1 Sensitive Information Disclosure

70RIESGO

abrir ↗

Referência

CVE-2019-9692

CVE-2019-9692—

class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard

50RIESGO

abrir ↗

Referência

CVE-2026-9402

CVE-2026-9402MEDIUM

Edimax BR-6675nD POST Request formWlanMP command injection

33RIESGO

abrir ↗

Referência

CVE-2026-9401

CVE-2026-9401HIGH

Edimax BR-6675nD POST Request formWanTcpipSetup buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2026-9400

CVE-2026-9400MEDIUM

Edimax BR-6675nD POST Request formUSBStorage command injection

33RIESGO

abrir ↗

Referência

CVE-2026-9399

CVE-2026-9399HIGH

Edimax BR-6675nD POST Request formsetPPPoE buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2026-9388

CVE-2026-9388CRITICAL

Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection

48RIESGO

abrir ↗

Referência

CVE-2026-9387

CVE-2026-9387CRITICAL

Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection

48RIESGO

abrir ↗

Referência

CVE-2026-9369

CVE-2026-9369MEDIUM

NousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard_plugins comparison

33RIESGO

abrir ↗

Referência

CVE-2026-9694

CVE-2026-9694LOW

Improper Neutralization of Substitution Characters in GitLab

28RIESGO

abrir ↗

Referência

CVE-2026-10087

CVE-2026-10087HIGH

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

41RIESGO

abrir ↗

Referência

CVE-2026-11476

CVE-2026-11476MEDIUM

Kushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin improper authorization

33RIESGO

abrir ↗

Referência

CVE-2026-11475

CVE-2026-11475MEDIUM

Kushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-11474

CVE-2026-11474MEDIUM

Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-11472

CVE-2026-11472MEDIUM

SourceCodester Class and Exam Timetabling System index1.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-11471

CVE-2026-11471MEDIUM

SourceCodester Class and Exam Timetabling System index2.php sql injection

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.