Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.794exploits catalogados
36.057CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.721 exploits
Referência✓ VexDay Proof
RKD Software BarCode ActiveX Control 'BarCodeAx.dll' 4.9 - Remote Overflow
CVE-2007-3435—remotewindows
Stack-based buffer overflow in the BeginPrint method in a certain ActiveX control in RKD Software (barcodetools.com) Bar
50RIESGO
abrir ↗
Referência
CVE-2017-17622
CVE-2017-17622—
Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17622
CVE-2017-17622—
Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.
23RIESGO
abrir ↗
Referência
CVE-2007-3530
CVE-2007-3530—
PHPDirector 0.21 and earlier stores the admin account name and password in config.php, which allows local users to gain
23RIESGO
abrir ↗
Referência
CVE-2017-17622
CVE-2017-17622—
Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-78137
CVE-2026-78137HIGH
StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart
41RIESGO
abrir ↗
Referência
CVE-2026-78125
CVE-2026-78125MEDIUM
LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-77018
CVE-2026-77018HIGH
Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment
41RIESGO
abrir ↗
Referência
CVE-2026-14924
CVE-2026-14924HIGH
Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification
41RIESGO
abrir ↗
Referência
CVE-2026-12394
CVE-2026-12394CRITICAL
MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator
63RIESGO
abrir ↗
Referência
CVE-2026-12255
CVE-2026-12255HIGH
MainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration
41RIESGO
abrir ↗
Referência
CVE-2026-10082
CVE-2026-10082MEDIUM
Advanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' Parameter
33RIESGO
abrir ↗
Referência
CVE-2017-17624
CVE-2017-17624—
PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php searchcat o
23RIESGO
abrir ↗
Referência
CVE-2017-17625
CVE-2017-17625—
Professional Service Script 1.0 has SQL Injection via the service-list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17625
CVE-2017-17625—
Professional Service Script 1.0 has SQL Injection via the service-list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17626
CVE-2017-17626—
Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-77017
CVE-2026-77017HIGH
Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment
41RIESGO
abrir ↗
Referência
CVE-2026-77016
CVE-2026-77016CRITICAL
Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment
48RIESGO
abrir ↗
Referência
CVE-2026-76549
CVE-2026-76549MEDIUM
UpdraftPlus < 1.26.7 - Backup Restoration via CSRF
33RIESGO
abrir ↗
Referência
CVE-2026-19715
CVE-2026-19715HIGH
WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
41RIESGO
abrir ↗
Referência
CVE-2026-19454
CVE-2026-19454MEDIUM
JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
33RIESGO
abrir ↗
Referência
CVE-2026-19225
CVE-2026-19225MEDIUM
Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite
33RIESGO
abrir ↗
Referência
CVE-2026-19223
CVE-2026-19223HIGH
Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Ripe Website Manager (CMS) 0.8.9 - Remote File Inclusion
CVE-2007-3524—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote attackers to e
35RIESGO
abrir ↗
Referência✓ VexDay Proof
Buddy Zone 1.5 - Multiple SQL Injections
CVE-2007-3526—webappsphp
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência
CVE-2026-13404
CVE-2026-13404MEDIUM
Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init
33RIESGO
abrir ↗
Referência
CVE-2026-13172
CVE-2026-13172MEDIUM
Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-10190
CVE-2026-10190HIGH
Tenda W12 Web Management httpd cgiSysWebTimeoutSet denial of service
41RIESGO
abrir ↗
Referência
CVE-2026-10187
CVE-2026-10187CRITICAL
Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow
48RIESGO
abrir ↗
Referência
CVE-2026-10186
CVE-2026-10186MEDIUM
code-projects Online Hospital Management System patient.php sql injection
33RIESGO
abrir ↗
← anteriorpágina 728 / 758siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.