Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.324exploits catalogados
36.054CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.721GitHub PoC 14.477VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.721 exploits
Referência
CVE-2026-12586
CVE-2026-12586HIGH
Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset
41RIESGO
abrir ↗
Referência
CVE-2026-11872
CVE-2026-11872MEDIUM
Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item
33RIESGO
abrir ↗
Referência
CVE-2026-14920
CVE-2026-14920HIGH
AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-58658
CVE-2026-58658HIGH
GPUStack Unauthenticated Information Disclosure via Worker Endpoints
41RIESGO
abrir ↗
Referência
CVE-2026-11580
CVE-2026-11580MEDIUM
Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-40500
CVE-2026-40500—
3RIESGO
abrir ↗
Referência
CVE-2026-39907
CVE-2026-39907HIGH
Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via WCF SOAP
41RIESGO
abrir ↗
Referência
CVE-2026-39906
CVE-2026-39906HIGH
Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting
41RIESGO
abrir ↗
Referência
CVE-2026-14845
CVE-2026-14845MEDIUM
NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget
33RIESGO
abrir ↗
Referência
CVE-2010-4614
CVE-2010-4614—
SQL injection vulnerability in item.php in Ero Auktion 2010 allows remote attackers to execute arbitrary SQL commands vi
23RIESGO
abrir ↗
Referência
CVE-2026-39808
CVE-2026-39808CRITICALbajo ataque
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F
100RIESGO
abrir ↗
Referência
CVE-2025-65133
CVE-2025-65133CRITICAL
A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated
48RIESGO
abrir ↗
Referência
CVE-2026-38533
CVE-2026-38533MEDIUM
An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attac
33RIESGO
abrir ↗
Referência
CVE-2026-14221
CVE-2026-14221LOW
Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization
28RIESGO
abrir ↗
Referência
CVE-2026-14188
CVE-2026-14188LOW
Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure
28RIESGO
abrir ↗
Referência
CVE-2026-66753
CVE-2026-66753MEDIUM
tiny-http 0.12.0 HTTP Response Splitting via Header Injection
33RIESGO
abrir ↗
Referência
CVE-2026-7676
CVE-2026-7676MEDIUM
kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7675
CVE-2026-7675HIGH
Shenzhen Libituo Technology LBT-T300-HW1 apply.cgi start_lan buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2026-7673
CVE-2026-7673MEDIUM
crmeb_java Admin Upload UploadServiceImpl.java unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-7644
CVE-2026-7644MEDIUM
ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-7643
CVE-2026-7643MEDIUM
ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy
33RIESGO
abrir ↗
Referência
CVE-2026-7642
CVE-2026-7642MEDIUM
pskill9 website-downloader MCP index.ts download_website os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-66750
CVE-2026-66750MEDIUM
Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
33RIESGO
abrir ↗
Referência
CVE-2026-29002
CVE-2026-29002HIGH
CouchCMS Privilege Escalation via f_k_levels_list Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-6038
CVE-2026-6038MEDIUM
code-projects Vehicle Showroom Management System RegisterCustomerFunction.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-6037
CVE-2026-6037MEDIUM
code-projects Vehicle Showroom Management System AddVehicleFunction.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-6036
CVE-2026-6036MEDIUM
code-projects Vehicle Showroom Management System VehicleDetailsFunction.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-6035
CVE-2026-6035MEDIUM
code-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-6034
CVE-2026-6034MEDIUM
code-projects Vehicle Showroom Management System ProfitAndLossReport.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-6033
CVE-2026-6033MEDIUM
CodeAstro Online Classroom updatedetailsfromstudent.php sql injection
33RIESGO
abrir ↗
← anteriorpágina 712 / 758siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.