Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
78.324exploits catalogados
36.054CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.721GitHub PoC 14.477VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.721 exploits
Referência
CVE-2026-19221
Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite
41RIESGO
abrir ↗Referência
CVE-2026-19093
Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path
33RIESGO
abrir ↗Referência
CVE-2026-14638
itsourcecode Hospital Management System patient.php sql injection
33RIESGO
abrir ↗Referência
CVE-2026-14637
kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization
41RIESGO
abrir ↗Referência
CVE-2026-18356
Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email
28RIESGO
abrir ↗Referência
CVE-2026-18781
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
41RIESGO
abrir ↗Referência
CVE-2026-12221
Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow
41RIESGO
abrir ↗Referência
CVE-2016-20064
WP Vault 0.8.6.6 Local File Inclusion via wpv-image Parameter
33RIESGO
abrir ↗Referência
CVE-2026-11524
Tenda W20E Web Management modifyWifiFilterRules stack-based overflow
41RIESGO
abrir ↗Referência
CVE-2026-11523
Tenda W20E Web Management PortalAuth formPortalAuth stack-based overflow
41RIESGO
abrir ↗Referência
CVE-2026-11465
songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error
28RIESGO
abrir ↗Referência
CVE-2026-11464
JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure
28RIESGO
abrir ↗Referência
CVE-2026-14601
Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter
33RIESGO
abrir ↗Referência✓ VexDay Proof
4Images 1.7.1 - Local File Inclusion / Remote Code Execution
Directory traversal vulnerability in index.php in 4Images 1.7.1 and earlier allows remote attackers to read and include
23RIESGO
abrir ↗Referência
CVE-2026-14325
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
28RIESGO
abrir ↗Referência
CVE-2019-25731
Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact
33RIESGO
abrir ↗Referência
CVE-2025-15671
Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter
33RIESGO
abrir ↗Referência
CVE-2026-16962
Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation
33RIESGO
abrir ↗Referência
CVE-2026-10210
AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection
33RIESGO
abrir ↗Referência
CVE-2019-25728
Care2x 2.7 Hospital Information System SQL Injection via ck_config
41RIESGO
abrir ↗Referência
CVE-2026-10771
crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery
33RIESGO
abrir ↗Referência
CVE-2026-7589
ghantakiran splunk-mcp-integration CSV Export csv_export.py create_csv_export path traversal
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.