Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

76.559exploits catalogados
34.978CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.443Referência 21.899GitHub PoC 13.960VulnCheck XDB 8542Nuclei 4243Metasploit 3472✓ solo verificadosrecientespopularesriesgo
21.899 exploits
Referência
CVE-2026-9474
CVE-2026-9474MEDIUM
yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-9473
CVE-2026-9473MEDIUM
c-rick jimeng-mcp api.ts generateVideo path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-63086
CVE-2026-63086MEDIUM
text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions
33RIESGO
abrir ↗
Referência
CVE-2026-63085
CVE-2026-63085HIGH
Axelor Open Platform 8.x < 8.2.2 Authorization Bypass via Nested Relational Record Persistence
41RIESGO
abrir ↗
Referência
CVE-2026-9472
CVE-2026-9472MEDIUM
dazeb markdown-downloader index.ts create_subdirectory path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-9471
CVE-2026-9471MEDIUM
yashpokharna2555 StudentManagementSystem student.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-9470
CVE-2026-9470MEDIUM
yashpokharna2555 StudentManagementSystem student_trans.php confirm_logged_in sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-9469
CVE-2026-9469MEDIUM
yashpokharna2555 StudentManagementSystem success.php sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Multiple Membership Script 2.5 - 'id' SQL Injection
CVE-2008-6362—webappsphp
SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2014-9418
CVE-2014-9418—
The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in Huawei eSpace Desktop before V200R001C03 allows local users
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Affiliate Software Java 4.0 - Authentication Bypass
CVE-2008-6366—webappsasp
SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to e
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Ocean12 Contact Manager Pro - SQL Injection / Cross-Site Scripting / File Disclosure
CVE-2008-6369—webappsphp
SQL injection vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2014-9439
CVE-2014-9439—
Cross-site scripting (XSS) vulnerability in Easy File Sharing Web Server 6.8 allows remote attackers to inject arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Ocean12 FAQ Manager Pro - 'ID' Blind SQL Injection
CVE-2008-6372—webappsphp
SQL injection vulnerability in default.asp in Ocean12 FAQ Manager Pro 1.0 allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Codefixer MailingListPro - Database Disclosure
CVE-2008-6374—webappsasp
CodefixerSoftware MailingListPro Free Edition stores sensitive information under the web root with insufficient access c
23RIESGO
abrir ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗
Referência
CVE-2008-6515
CVE-2008-6515—
Cross-site scripting (XSS) vulnerability in Fritz Berger yet another php photo album - next generation (yappa-ng) allows
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Pro Chat Rooms 3.0.2 - Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-6501—webappsphp
Cross-site scripting (XSS) vulnerability in profiles/index.php in Pro Chat Rooms 3.0.2 allows remote attackers to inject
23RIESGO
abrir ↗
Referência
CVE-2026-9810
CVE-2026-9810CRITICAL
AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth
48RIESGO
abrir ↗
Referência✓ VexDay Proof
Pro Chat Rooms 3.0.2 - Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-6502—webappsphp
Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-6508—webappsjsp
Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows rem
60RIESGO
abrir ↗
Referência
CVE-2026-15594
CVE-2026-15594MEDIUM
waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-13578
CVE-2026-13578MEDIUM
itsourcecode Hospital Management System patientdetail.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-13574
CVE-2026-13574MEDIUM
llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-13571
CVE-2026-13571MEDIUM
SourceCodester Simple Food Ordering System cart.php logic error
33RIESGO
abrir ↗
Referência
CVE-2026-13569
CVE-2026-13569MEDIUM
weng-xianhu EyouCMS API index.php sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-6511—webappsjsp
Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arb
23RIESGO
abrir ↗
← anteriorpágina 324 / 730siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.