Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.634exploits catalogados

40.286CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.110Exploit-DB 24.488GitHub PoC 17.941VulnCheck XDB 10.016Nuclei 4547Metasploit 3532✓ solo verificadosrecientes populares riesgo

26.110 exploits

Referência

CVE-2026-10169

CVE-2026-10169MEDIUM

OUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax_forgot_password password recovery

33RIESGO

abrir ↗

Referência

CVE-2026-7393

CVE-2026-7393MEDIUM

SourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-7680

CVE-2026-7680MEDIUM

jsbroks COCO Annotator Data Endpoint datasets.py path traversal

33RIESGO

abrir ↗

Referência

CVE-2012-2587

CVE-2012-2587—

Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arb

23RIESGO

abrir ↗

Referência

CVE-2026-6989

CVE-2026-6989MEDIUM

Tenda F453 Telnet Service telnet TendaTelnet command injection

33RIESGO

abrir ↗

Referência

CVE-2026-6988

CVE-2026-6988HIGH

Tenda HG10 Boa Service formRouting formRoute buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2026-6986

CVE-2026-6986MEDIUM

Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification

33RIESGO

abrir ↗

Referência

CVE-2014-8998

CVE-2014-8998—

lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a c

50RIESGO

abrir ↗

Referência

CVE-2016-7508

CVE-2016-7508—

Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL co

23RIESGO

abrir ↗

Referência

CVE-2026-6985

CVE-2026-6985MEDIUM

Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop

33RIESGO

abrir ↗

Referência

CVE-2026-6984

CVE-2026-6984MEDIUM

AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine

33RIESGO

abrir ↗

Referência✓ VexDay Proof

DESlock+ < 3.2.6 - 'LIST' Local Kernel Memory Leak

CVE-2008-1141—localwindows

Memory leak in DLMFENC.sys 1.0.0.26 in DESlock+ 3.2.6 and earlier allows local users to cause a denial of service (kerne

23RIESGO

abrir ↗

Referência

CVE-2018-15917

CVE-2018-15917—

Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HT

38RIESGO

abrir ↗

Referência✓ VexDay Proof

Ruby 1.8.6/1.9 (WEBick HTTPd 1.3.1) - Directory Traversal

CVE-2008-1145—remotemultiple

Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when

28RIESGO

abrir ↗

Referência

CVE-2010-5099

CVE-2010-5099—

The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.

23RIESGO

abrir ↗

Referência

CVE-2026-10239

CVE-2026-10239MEDIUM

JeecgBoot edit WordUtil.addImage server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2018-25431

CVE-2018-25431HIGH

No-Cms 1.0 SQL Injection via order_by Parameter

41RIESGO

abrir ↗

Referência

CVE-2026-10234

CVE-2026-10234MEDIUM

Mettle sendportal Campaign webview cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2013-5694

CVE-2013-5694—

SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows remote attackers to execute arb

23RIESGO

abrir ↗

Referência

CVE-2026-10184

CVE-2026-10184MEDIUM

SourceCodester Hospitals Patient Records Management System Users.php delete sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-6990

CVE-2026-6990MEDIUM

projeto-siga novo cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2012-4057

CVE-2012-4057—

Buffer overflow in the Player in Remote-Anything 5.60.15 allows remote attackers to execute arbitrary code via a crafted

23RIESGO

abrir ↗

Referência

CVE-2026-9607

CVE-2026-9607MEDIUM

itsourcecode Courier Management System parcel_list.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-10164

CVE-2026-10164HIGH

Edimax BR-6478AC POST Request formUSBFolder buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2026-8194

CVE-2026-8194MEDIUM

osTicket Dispatcher class.dispatcher.php cross-site request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-8193

CVE-2026-8193MEDIUM

Akaunting Invoice PDF Rendering dompdf.php server-side request forgery

33RIESGO

abrir ↗

Referência

TP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated)

CVE-2022-30075—remotehardware

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote

35RIESGO

abrir ↗

Referência

CVE-2026-9579

CVE-2026-9579MEDIUM

JeecgBoot SysUser userEdit user.getUsername access control

33RIESGO

abrir ↗

Referência

CVE-2026-9567

CVE-2026-9567MEDIUM

GPAC MP4Box isom_intern.c MergeFragment null pointer dereference

33RIESGO

abrir ↗

Referência

CVE-2026-8192

CVE-2026-8192MEDIUM

Wavlink NU516U1 adm.cgi wzdap os command injection

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.