Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.388exploits catalogados
40.212CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 9990Nuclei 4547Metasploit 3531✓ solo verificadosrecientespopularesriesgo
26.070 exploits
Referência
CVE-2009-4832
CVE-2009-4832—
The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x80
23RIESGO
abrir ↗
Referência
CVE-2010-4870
CVE-2010-4870—
SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗
Referência
CVE-2014-1202
CVE-2014-1202—
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a c
23RIESGO
abrir ↗
Referência
CVE-2026-6621
CVE-2026-6621MEDIUM
1024bit extend-deep index.js prototype pollution
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Yahoo! Music JukeBox 2.2 - 'AddButton()' ActiveX Remote Buffer Overflow
CVE-2008-0624—remotewindows
Buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! JukeBox 2.2.2.56 allows remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2016-5237
CVE-2016-5237—
Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to m
23RIESGO
abrir ↗
Referência
CVE-2026-7214
CVE-2026-7214MEDIUM
eghuzefa engineer-your-data server.py file_inf path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7213
CVE-2026-7213MEDIUM
ef10007 MLOps_MCP save_file Tool fastmcp_server.py path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7212
CVE-2026-7212MEDIUM
edvardlindelof notes-mcp notes_mcp.py path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7211
CVE-2026-7211MEDIUM
dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection
33RIESGO
abrir ↗
Referência
CVE-2026-7206
CVE-2026-7206MEDIUM
dubydu sqlite-mcp entry.py extract_to_json sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7205
CVE-2026-7205MEDIUM
duartium papers-mcp-server main.py search_papers path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7204
CVE-2026-7204CRITICAL
Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7203
CVE-2026-7203CRITICAL
Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7136
CVE-2026-7136CRITICAL
Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7135
CVE-2026-7135MEDIUM
GPAC MP4Box box_code_base.c elng_box_read out-of-bounds
33RIESGO
abrir ↗
Referência
CVE-2026-41467
CVE-2026-41467MEDIUM
ProjeQtor < 12.4.4 Stored XSS via checkValidFileName()
33RIESGO
abrir ↗
Referência
CVE-2026-38651
CVE-2026-38651HIGH
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jw
41RIESGO
abrir ↗
Referência
CVE-2026-7202
CVE-2026-7202CRITICAL
Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7146
CVE-2026-7146MEDIUM
AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-7143
CVE-2026-7143MEDIUM
1000 Projects Portfolio Management System MCA block_status.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7142
CVE-2026-7142MEDIUM
Wooey API Endpoint scripts.py add_or_update_script improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-7141
CVE-2026-7141MEDIUM
vLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resource
33RIESGO
abrir ↗
Referência
CVE-2026-7140
CVE-2026-7140CRITICAL
Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7139
CVE-2026-7139CRITICAL
Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7138
CVE-2026-7138CRITICAL
Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7137
CVE-2026-7137CRITICAL
Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-41467
CVE-2026-41467MEDIUM
ProjeQtor < 12.4.4 Stored XSS via checkValidFileName()
33RIESGO
abrir ↗
Referência
CVE-2026-41466
CVE-2026-41466MEDIUM
ProjeQtor < 12.4.4 Stored XSS via checkValidHtmlText()
33RIESGO
abrir ↗
Referência
CVE-2010-0951
CVE-2010-0951—
SQL injection vulnerability in go_target.php in dev4u CMS allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
← anteriorpágina 229 / 869siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.