Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.989exploits catalogados

40.450CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.042VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.240 exploits

Referência

CVE-2026-14834

CVE-2026-14834MEDIUM

Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX

33RIESGO

abrir ↗

Referência

CVE-2026-14833

CVE-2026-14833MEDIUM

Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute

33RIESGO

abrir ↗

Referência

CVE-2013-7091

CVE-2013-7091—

Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zim

60RIESGO

abrir ↗

Referência

SPBAS Business Automation Software 2012 - Multiple Vulnerabilities

CVE-2013-4664—webappsphp

SPBAS Business Automation Software 2012 has XSS.

23RIESGO

abrir ↗

Referência

CVE-2013-4692

CVE-2013-4692—

Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS

23RIESGO

abrir ↗

Referência

CVE-2016-5304

CVE-2016-5304—

Open redirect vulnerability in a report-routing component in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6

23RIESGO

abrir ↗

Referência

CVE-2026-16064

CVE-2026-16064MEDIUM

Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event

33RIESGO

abrir ↗

Referência

CVE-2026-66007

CVE-2026-66007MEDIUM

Datasets Path Traversal via Unsanitized file_name Metadata

33RIESGO

abrir ↗

Referência

CVE-2026-5657

CVE-2026-5657MEDIUM

Double Free in Wireshark

33RIESGO

abrir ↗

Referência

CVE-2013-0230

CVE-2013-0230—

Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP

50RIESGO

abrir ↗

Referência

CVE-2026-8985

CVE-2026-8985CRITICAL

Unauthenticated Command Injection

48RIESGO

abrir ↗

Referência✓ VexDay Proof

AJ HYIP ACME - 'comment.php' SQL Injection

CVE-2008-4043—webappsphp

Multiple SQL injection vulnerabilities in AJ Square AJ HYIP Acme allow remote attackers to execute arbitrary SQL command

23RIESGO

abrir ↗

Referência

CVE-2026-7604

CVE-2026-7604MEDIUM

JeecgBoot OpenApi Service OpenApiController.java OpenApiController.call server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-17531

CVE-2026-17531LOW

unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization

28RIESGO

abrir ↗

Referência

CVE-2026-8984

CVE-2026-8984CRITICAL

Unauthenticated RCE

48RIESGO

abrir ↗

Referência

CVE-2026-7319

CVE-2026-7319MEDIUM

elinsky execution-system-mcp add_action Tool server.py _get_context_file_path path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-7318

CVE-2026-7318MEDIUM

elie mcp-project research_server.py search_papers path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-7317

CVE-2026-7317LOW

Grav CMS Cache Value FileCache.php doGet deserialization

28RIESGO

abrir ↗

Referência

CVE-2026-7316

CVE-2026-7316MEDIUM

eiliyaabedini aider-mcp code_with_ai aider_mcp.py command injection

33RIESGO

abrir ↗

Referência

CVE-2026-7314

CVE-2026-7314MEDIUM

eiceblue spire-doc-mcp-server base.py get_doc_path path traversal

33RIESGO

abrir ↗

Referência

CVE-2015-1305

CVE-2015-1305—

McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to arbitrary memory locations, an

23RIESGO

abrir ↗

Referência

CVE-2018-25299

CVE-2018-25299HIGH

Prime95 29.4b8 Local Buffer Overflow via SEH

41RIESGO

abrir ↗

Referência

CVE-2018-25298

CVE-2018-25298MEDIUM

Merge PACS 7.0 Cross-Site Request Forgery via merge-viewer

33RIESGO

abrir ↗

Referência

CVE-2026-7401

CVE-2026-7401MEDIUM

SourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-7400

CVE-2026-7400MEDIUM

geekgod382 filesystem-mcp-server read_file_tool/write_file_tool server.py is_path_allowed path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-7386

CVE-2026-7386MEDIUM

fatbobman mail-mcp-bridge mail_mcp_server.py path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-16448

CVE-2026-16448MEDIUM

D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection

33RIESGO

abrir ↗

Referência

CVE-2026-15205

CVE-2026-15205HIGH

Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup

41RIESGO

abrir ↗

Referência

CVE-2026-18035

CVE-2026-18035MEDIUM

User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API

33RIESGO

abrir ↗

Referência

CVE-2026-19074

CVE-2026-19074MEDIUM

Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.