Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.832 exploits
Referência
CVE-2024-14043
CVE-2024-14043MEDIUM
Open5GS Diameter S6a mme-fd-path.c mme_s6a_subscription_data_from_avp heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2024-14042
CVE-2024-14042MEDIUM
Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflow
33RIESGO
abrir ↗
Referência
CVE-2022-50997
CVE-2022-50997HIGH
Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp
41RIESGO
abrir ↗
Referência
CVE-2019-25744
CVE-2019-25744MEDIUM
WordPress Popup Builder 3.49 Persistent Cross-Site Scripting
33RIESGO
abrir ↗
Referência
CVE-2019-25743
CVE-2019-25743MEDIUM
WordPress Soliloquy Lite 2.5.6 Persistent Cross-Site Scripting
33RIESGO
abrir ↗
Referência
CVE-2019-25742
CVE-2019-25742MEDIUM
WordPress Theme Zoner Real Estate 4.1.1 Persistent XSS
33RIESGO
abrir ↗
Referência
CVE-2019-25738
CVE-2019-25738CRITICAL
WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change
48RIESGO
abrir ↗
Referência
CVE-2019-25737
CVE-2019-25737MEDIUM
Live Chat Unlimited 2.8.3 Stored Cross-Site Scripting
33RIESGO
abrir ↗
Referência
CVE-2019-25736
CVE-2019-25736HIGH
LabF nfsAxe 3.7 Ping Client Buffer Overflow
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Clansys 1.1 (showid) - SQL Injection
CVE-2006-1708—webappsphp
SQL injection vulnerability in member.php in Clansys 1.1 allows remote attackers to execute arbitrary SQL commands via t
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Fast Click 1.1.3/2.3.8 - 'show.php' Remote File Inclusion
CVE-2006-2175—webappsphp
PHP remote file inclusion vulnerability in FtrainSoft Fast Click 2.3.8 and earlier allows remote attackers to execute ar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
XM Easy Personal FTP Server 1.0 - 'Port' Remote Overflow (PoC)
CVE-2006-2226—doswindows
Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of serv
23RIESGO
abrir ↗
Referência
CVE-2026-9428
CVE-2026-9428HIGH
Tenda F1202 PPTPUserSetting fromPPTPUserSetting stack-based overflow
41RIESGO
abrir ↗
Referência✓ VexDay Proof
TopList 1.3.8 - 'phpBB Hack' Remote File Inclusion (2)
CVE-2006-2151—webappsphp
PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enab
28RIESGO
abrir ↗
Referência✓ VexDay Proof
X7 Chat 2.0 - 'help_file' Remote Command Execution
CVE-2006-2156—webappsphp
Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitr
23RIESGO
abrir ↗
Referência
CVE-2018-25350
CVE-2018-25350CRITICAL
userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php
48RIESGO
abrir ↗
Referência
CVE-2018-25340
CVE-2018-25340HIGH
Smartshop 1 SQL Injection via category.php
41RIESGO
abrir ↗
Referência
CVE-2026-9306
CVE-2026-9306MEDIUM
QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization
33RIESGO
abrir ↗
Referência
CVE-2026-9305
CVE-2026-9305MEDIUM
QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14767
CVE-2026-14767MEDIUM
CodeAstro Ecommerce Website POST Parameter confirm.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-17044
CVE-2026-17044HIGH
WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid
41RIESGO
abrir ↗
Referência
CVE-2026-16992
CVE-2026-16992MEDIUM
Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
33RIESGO
abrir ↗
Referência
CVE-2026-14766
CVE-2026-14766MEDIUM
CodeAstro Apartment Visitor Management System POST Parameter search-result.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14764
CVE-2026-14764MEDIUM
code-projects Hotel and Tourism Reservation Event Management add_event.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-9304
CVE-2026-9304LOW
calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery
28RIESGO
abrir ↗
Referência
CVE-2026-9303
CVE-2026-9303MEDIUM
calcom cal.diy cross-site request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-17014
CVE-2026-17014MEDIUM
WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips
33RIESGO
abrir ↗
Referência
CVE-2026-17011
CVE-2026-17011LOW
Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection
28RIESGO
abrir ↗
Referência
CVE-2026-16988
CVE-2026-16988HIGH
GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint
41RIESGO
abrir ↗
Referência
CVE-2026-14763
CVE-2026-14763MEDIUM
code-projects Hotel and Tourism Reservation Tour Reservations tour_reserves.php sql injection
33RIESGO
abrir ↗
← anteriorpágina 745 / 762siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.