Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.295exploits catalogados
36.048CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.721GitHub PoC 14.464VulnCheck XDB 8813Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.657 exploits
Referência✓ VexDay Proof
phpAuction - 'profile.php' SQL Injection (1)
CVE-2008-6663—webappsphp
SQL injection vulnerability in profile.php in PHPAuctions.info PHPAuctions (aka PHPAuctionSystem) allows remote attacker
23RIESGO
abrir ↗
Referência
CVE-2016-5195
CVE-2016-5195HIGHbajo ataque
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RIESGO
abrir ↗
Referência✓ VexDay Proof
nweb2fax 0.2.7 - Multiple Vulnerabilities
CVE-2008-6669—webappsphp
viewrq.php in nweb2fax 0.2.7 and earlier allows remote attackers to execute arbitrary code via shell metacharacters in t
23RIESGO
abrir ↗
Referência
CVE-2016-5195
CVE-2016-5195HIGHbajo ataque
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RIESGO
abrir ↗
Referência
CVE-2016-5195
CVE-2016-5195HIGHbajo ataque
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RIESGO
abrir ↗
Referência
CVE-2016-5195
CVE-2016-5195HIGHbajo ataque
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RIESGO
abrir ↗
Referência
CVE-2016-5195
CVE-2016-5195HIGHbajo ataque
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RIESGO
abrir ↗
Referência
CVE-2016-5195
CVE-2016-5195HIGHbajo ataque
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RIESGO
abrir ↗
Referência
CVE-2016-5195
CVE-2016-5195HIGHbajo ataque
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RIESGO
abrir ↗
Referência
CVE-2026-75976
CVE-2026-75976CRITICAL
TRENDnet TEW-823DRU NVRAM wan.cgi strcpy stack-based overflow
48RIESGO
abrir ↗
Referência
CVE-2014-0329
CVE-2014-0329—
The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account
23RIESGO
abrir ↗
Referência
CVE-2014-0476
CVE-2014-0476—
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute a
38RIESGO
abrir ↗
Referência
CVE-2026-7121
CVE-2026-7121CRITICAL
Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-16632
CVE-2026-16632MEDIUM
boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation
33RIESGO
abrir ↗
Referência
CVE-2026-16631
CVE-2026-16631MEDIUM
publint package-manager pack.js child_process.exec os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-65013
CVE-2026-65013HIGH
Onlook tRPC Insecure Direct Object Reference via multiple procedures
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Absolute Banner Manager - Insecure Cookie Handling
CVE-2008-6858—webappsphp
Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by sett
23RIESGO
abrir ↗
Referência
CVE-2026-30368
CVE-2026-30368MEDIUM
A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersona
33RIESGO
abrir ↗
Referência
CVE-2026-26210
CVE-2026-26210CRITICAL
KTransformers Unsafe Deserialization RCE via balance_serve
48RIESGO
abrir ↗
Referência
CVE-2026-6942
CVE-2026-6942CRITICAL
radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass
28RIESGO
abrir ↗
Referência
CVE-2026-6941
CVE-2026-6941MEDIUM
radare2 < 6.1.4 Project Notes Path Traversal via Symlink
13RIESGO
abrir ↗
Referência
CVE-2026-6940
CVE-2026-6940MEDIUM
radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion
13RIESGO
abrir ↗
Referência
CVE-2026-25874
CVE-2026-25874CRITICAL
LeRobot Unsafe Deserialization Remote Code Execution via gRPC
53RIESGO
abrir ↗
Referência
CVE-2026-23751
CVE-2026-23751CRITICAL
Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting
48RIESGO
abrir ↗
Referência
CVE-2026-41460
CVE-2026-41460CRITICAL
SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall
48RIESGO
abrir ↗
Referência
CVE-2026-4512
CVE-2026-4512LOW
WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS
28RIESGO
abrir ↗
Referência
CVE-2026-4106
CVE-2026-4106MEDIUM
HT Mega < 3.0.7 – Unauthenticated PII Disclosure
48RIESGO
abrir ↗
Referência
CVE-2026-6878
CVE-2026-6878MEDIUM
ByteDance verl grader.py math_equal sandbox
33RIESGO
abrir ↗
Referência
CVE-2026-6874
CVE-2026-6874MEDIUM
ericc-ch copilot-api Header token dns rebinding
33RIESGO
abrir ↗
Referência
CVE-2026-40517
CVE-2026-40517HIGH
radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names
41RIESGO
abrir ↗
← anteriorpágina 696 / 756siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.