Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.324exploits catalogados

36.054CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.458Referência 22.721GitHub PoC 14.477VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientes populares riesgo

22.721 exploits

Referência

CVE-2026-9528

CVE-2026-9528MEDIUM

itsourcecode Electronic Judging System delete_judge.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-13712

CVE-2026-13712MEDIUM

Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL

33RIESGO

abrir ↗

Referência

CVE-2026-19919

CVE-2026-19919MEDIUM

code-projects Online Shopping System Login login.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-19918

CVE-2026-19918MEDIUM

SpaceX Starlink Router Gen 3 gRPC Management get_status access control

33RIESGO

abrir ↗

Referência

CVE-2026-19917

CVE-2026-19917MEDIUM

code-projects Online Food Order System delete_food_items1.php sql injection

33RIESGO

abrir ↗

Referência✓ VexDay Proof

JASmine 0.0.2 - 'index.php' Remote File Inclusion

CVE-2006-5318—webappsphp

PHP remote file inclusion vulnerability in index.php in Nayco JASmine (aka Jasmine-Web) allows remote attackers to execu

23RIESGO

abrir ↗

Referência✓ VexDay Proof

CSPartner 1.0 - Delete All Users / SQL Injection

CVE-2008-6165—webappsphp

SQL injection vulnerability in gestion.php in CSPartner 0.1, when magic_quotes_gpc is disabled, allows remote attackers

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Foafgen 0.3 - 'redir.php' Local Source Disclosure

CVE-2006-5319—webappsphp

Directory traversal vulnerability in redir.php in Foafgen 0.3 allows remote attackers to read arbitrary files via a .. (

23RIESGO

abrir ↗

Referência

CVE-2014-7186

CVE-2014-7186—

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial o

35RIESGO

abrir ↗

Referência

CVE-2019-6716

CVE-2019-6716—

An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 thr

23RIESGO

abrir ↗

Referência

CVE-2014-7190

CVE-2014-7190—

Multiple cross-site request forgery (CSRF) vulnerabilities in Openfiler 2.99.1 allow remote attackers to hijack the auth

23RIESGO

abrir ↗

Referência

CVE-2026-1659

CVE-2026-1659HIGH

Allocation of Resources Without Limits or Throttling in GitLab

41RIESGO

abrir ↗

Referência

CVE-2026-2900

CVE-2026-2900LOW

Missing Authorization in GitLab

28RIESGO

abrir ↗

Referência

CVE-2022-50962

CVE-2022-50962MEDIUM

uBidAuction 2.0.1 myOrders Reflected XSS

33RIESGO

abrir ↗

Referência

CVE-2022-50962

CVE-2022-50962MEDIUM

uBidAuction 2.0.1 myOrders Reflected XSS

33RIESGO

abrir ↗

Referência

CVE-2022-50961

CVE-2022-50961MEDIUM

WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS

33RIESGO

abrir ↗

Referência✓ VexDay Proof

AROUNDMe 0.5.2 - 'templatePath' Remote File Inclusion

CVE-2006-5401—webappsphp

PHP remote file inclusion vulnerability in template/barnraiser_01/p_new_password.tpl.php in AROUNDMe 0.5.2 and earlier a

23RIESGO

abrir ↗

Referência

CVE-2026-19762

CVE-2026-19762MEDIUM

DTStack Taier Chunk-Check Endpoint FileChunkController.java Paths.ge path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-7683

CVE-2026-7683MEDIUM

Edimax BR-6428nC Web setWAN command injection

33RIESGO

abrir ↗

Referência

CVE-2017-12542

CVE-2017-12542—

A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53

60RIESGO

abrir ↗

Referência

CVE-2026-19758

CVE-2026-19758MEDIUM

dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal

33RIESGO

abrir ↗

Referência

CVE-2014-8800

CVE-2014-8800—

Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Easynews 4.4.1 - 'admin.php' Authentication Bypass

CVE-2006-5412—webappsphp

admin.php in PHP Outburst Easynews 4.4.1 and earlier, when register_globals is enabled, allows remote attackers to bypas

23RIESGO

abrir ↗

Referência

CVE-2026-19750

CVE-2026-19750CRITICAL

Tenda CH/CP/TX3 SSH hard-coded password

48RIESGO

abrir ↗

Referência

CVE-2014-8904

CVE-2014-8904—

lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM

23RIESGO

abrir ↗

Referência

CVE-2026-9565

CVE-2026-9565MEDIUM

haojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injection

33RIESGO

abrir ↗

Referência

CVE-2014-8948

CVE-2014-8948—

Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows re

23RIESGO

abrir ↗

Referência

CVE-2026-14211

CVE-2026-14211LOW

Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

28RIESGO

abrir ↗

Referência

CVE-2026-8733

CVE-2026-8733MEDIUM

Investintech SlimPDFReader SlimPDFReader.exe sub_3B4610 stack-based overflow

33RIESGO

abrir ↗

Referência

CVE-2026-8731

CVE-2026-8731MEDIUM

Open5GS NRF client.c ogs_sbi_client_add denial of service

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.