Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.832 exploits
Referência✓ VexDay Proof
X7 Chat 2.0.4 - 'old_prefix' Blind SQL Injection
CVE-2006-3851—webappsphp
SQL injection vulnerability in upgradev1.php in X7 Chat 2.0.4 and earlier allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência
CVE-2006-3823
CVE-2006-3823—
SQL injection vulnerability in index.php in GeodesicSolutions (1) GeoAuctions Premier 2.0.3 and (2) GeoClassifieds Basic
23RIESGO
abrir ↗
Referência
CVE-2006-3823
CVE-2006-3823—
SQL injection vulnerability in index.php in GeodesicSolutions (1) GeoAuctions Premier 2.0.3 and (2) GeoClassifieds Basic
23RIESGO
abrir ↗
Referência
CVE-2026-57518
CVE-2026-57518HIGH
Pagekit CMS 1.0.18 Privilege Escalation via UserApiController
41RIESGO
abrir ↗
Referência
CVE-2026-45257
CVE-2026-45257HIGH
Arbitrary file overwrite via the KTLS receive path
41RIESGO
abrir ↗
Referência
CVE-2026-18607
CVE-2026-18607HIGH
Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-18606
CVE-2026-18606HIGH
Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management
41RIESGO
abrir ↗
Referência
CVE-2026-67612
CVE-2026-67612MEDIUM
OpenEMR 8.2.0 Stored XSS via import_template.php Template Management
33RIESGO
abrir ↗
Referência
CVE-2026-13714
CVE-2026-13714CRITICAL
Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
48RIESGO
abrir ↗
Referência
CVE-2026-12877
CVE-2026-12877CRITICAL
Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter
48RIESGO
abrir ↗
Referência
CVE-2026-12690
CVE-2026-12690LOW
ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
28RIESGO
abrir ↗
Referência
CVE-2018-17254
CVE-2018-17254—
The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
60RIESGO
abrir ↗
Referência
CVE-2026-13390
CVE-2026-13390MEDIUM
The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation
33RIESGO
abrir ↗
Referência
CVE-2026-13332
CVE-2026-13332CRITICAL
Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)
48RIESGO
abrir ↗
Referência
CVE-2026-64828
CVE-2026-64828MEDIUM
Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field
33RIESGO
abrir ↗
Referência
CVE-2026-13152
CVE-2026-13152HIGH
Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation
41RIESGO
abrir ↗
Referência
CVE-2026-12493
CVE-2026-12493HIGH
Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order
41RIESGO
abrir ↗
Referência
CVE-2026-65010
CVE-2026-65010MEDIUM
Datasets Symlink-following Arbitrary File Write via Extractor.extract()
33RIESGO
abrir ↗
Referência
CVE-2026-16490
CVE-2026-16490MEDIUM
itsourcecode Hospital Management System prescription.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-67611
CVE-2026-67611HIGH
OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
41RIESGO
abrir ↗
Referência
CVE-2026-39932
CVE-2026-39932CRITICAL
OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection
48RIESGO
abrir ↗
Referência
CVE-2006-3995
CVE-2006-3995—
Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Mambo Component User Home Pages 0.5 - Remote File Inclusion
CVE-2006-3995—webappsphp
Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php
28RIESGO
abrir ↗
Referência
CVE-2026-63765
CVE-2026-63765HIGH
Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Kayako eSupport 2.3.1 - 'subd' Remote File Inclusion
CVE-2006-4011—webappsphp
PHP remote file inclusion vulnerability in esupport/admin/autoclose.php in Kayako eSupport 2.3.1 and earlier, when regis
23RIESGO
abrir ↗
Referência
CVE-2026-13690
CVE-2026-13690HIGH
UsersWP < 1.2.67 - Two-Factor Authentication Bypass
41RIESGO
abrir ↗
Referência
CVE-2026-12981
CVE-2026-12981HIGH
CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset
41RIESGO
abrir ↗
Referência
CVE-2026-10232
CVE-2026-10232MEDIUM
Assimp ASE File scene.cpp ~aiNode use after free
33RIESGO
abrir ↗
Referência
CVE-2026-10231
CVE-2026-10231MEDIUM
Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp extract_anim_value heap-based overflow
33RIESGO
abrir ↗
Referência✓ VexDay Proof
MyBloggie 2.1.4 - 'trackback.php' Multiple SQL Injections
CVE-2006-4042—webappsphp
Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers
23RIESGO
abrir ↗
← anteriorpágina 747 / 762siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.