Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.832 exploits
Referência
CVE-2026-17542
CVE-2026-17542HIGH
Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
41RIESGO
abrir ↗
Referência✓ VexDay Proof
XMPlay 3.3.0.4 - '.M3U' Filename Local Buffer Overflow
CVE-2006-6063—localwindows
Stack-based buffer overflow in Un4seen XMPlay 3.3.0.5 and earlier allows remote attackers to execute arbitrary code via
50RIESGO
abrir ↗
Referência
CVE-2026-15048
CVE-2026-15048HIGH
GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History
41RIESGO
abrir ↗
Referência
CVE-2026-14931
CVE-2026-14931MEDIUM
JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-14930
CVE-2026-14930HIGH
JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload
41RIESGO
abrir ↗
Referência
CVE-2026-14929
CVE-2026-14929MEDIUM
JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-14928
CVE-2026-14928MEDIUM
JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject
33RIESGO
abrir ↗
Referência
CVE-2026-14927
CVE-2026-14927LOW
FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Powies pForum 1.29a - 'editpoll.php' SQL Injection
CVE-2006-6038—webappsphp
SQL injection vulnerability in editpoll.php in Powie's PHP Forum (pForum) 1.29a and earlier allows remote attackers to e
23RIESGO
abrir ↗
Referência✓ VexDay Proof
e-Ark 1.0 - '/src/ark_inc.php' Remote File Inclusion
CVE-2006-6086—webappsphp
PHP remote file inclusion vulnerability in src/ark_inc.php in e-Ark 1.0 allows remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗
Referência
CVE-2026-14922
CVE-2026-14922MEDIUM
WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment
33RIESGO
abrir ↗
Referência
CVE-2026-19229
CVE-2026-19229MEDIUM
SourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-19213
CVE-2026-19213MEDIUM
WonderTrader Pending Order TraderAdapter.h _undone_qty behavioral workflow
33RIESGO
abrir ↗
Referência
CVE-2026-19212
CVE-2026-19212MEDIUM
WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable
33RIESGO
abrir ↗
Referência
CVE-2026-19211
CVE-2026-19211MEDIUM
SourceCodester Photo Share Website ajax.php signup sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-66746
CVE-2026-66746MEDIUM
Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
33RIESGO
abrir ↗
Referência
CVE-2026-14798
CVE-2026-14798MEDIUM
CodeAstro Apartment Visitor Management System visitor-entry.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-15193
CVE-2026-15193MEDIUM
AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-15184
CVE-2026-15184MEDIUM
GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference
33RIESGO
abrir ↗
Referência
CVE-2018-19113
CVE-2018-19113—
The Pronestor PNHM (aka Health Monitoring or HealthMonitor) add-in before 8.1.13.0 for Outlook has "BUILTIN\Users:(I)(F)
23RIESGO
abrir ↗
Referência✓ VexDay Proof
SimpleBlog 2.3 - '/admin/edit.asp' SQL Injection
CVE-2006-6191—webappsasp
SQL injection vulnerability in admin/edit.asp in 8pixel.net simpleblog 2.3 and earlier allows remote attackers to execut
23RIESGO
abrir ↗
Referência
CVE-2026-39931
CVE-2026-39931HIGH
OpenEMR Authenticated SQL Injection via backup.php Import Feature
41RIESGO
abrir ↗
Referência
CVE-2026-41453
CVE-2026-41453HIGH
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-18604
CVE-2026-18604MEDIUM
textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PEGames - 'index.php' Remote File Inclusion
CVE-2006-6213—webappsphp
index.php in PEGames uses the extract function to overwrite critical variables, which allows remote attackers to conduct
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Wallpaper Complete Website 1.0.09 - SQL Injection
CVE-2006-6214—webappsphp
SQL injection vulnerability in wallpaper.php in Wallpaper Website (Wallpaper Complete Website) 1.0.09 allows remote atta
23RIESGO
abrir ↗
Referência
CVE-2026-13693
CVE-2026-13693MEDIUM
Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal
33RIESGO
abrir ↗
Referência
CVE-2023-47268
CVE-2023-47268MEDIUM
In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrar
33RIESGO
abrir ↗
Referência
CVE-2024-46508
CVE-2024-46508HIGH
yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Hacks List phpBB Mod 1.21 - SQL Injection
CVE-2006-6216—webappsphp
SQL injection vulnerability in admin_hacks_list.php in the Nivisec Hacks List 1.21 and earlier phpBB module allows remot
23RIESGO
abrir ↗
← anteriorpágina 750 / 762siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.