Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.533exploits catalogados

35.607CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.455Referência 22.407GitHub PoC 14.247VulnCheck XDB 8663Nuclei 4287Metasploit 3474✓ solo verificadosrecientes populares riesgo

22.367 exploits

Referência✓ VexDay Proof

Alstrasoft Web Email Script Enterprise - 'id' SQL Injection

CVE-2008-5751—webappsphp

SQL injection vulnerability in index.php in AlstraSoft Web Email Script Enterprise (ESE) allows remote attackers to exec

23RIESGO

abrir ↗

Referência

CVE-2026-38764

CVE-2026-38764HIGH

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kerne

41RIESGO

abrir ↗

Referência

CVE-2026-16628

CVE-2026-16628MEDIUM

oclif JIT Plugin Entry child_process.exec os command injection

33RIESGO

abrir ↗

Referência

CVE-2026-12968

CVE-2026-12968HIGH

Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload

41RIESGO

abrir ↗

Referência

CVE-2026-8989

CVE-2026-8989HIGH

Open Recovery Mode

41RIESGO

abrir ↗

Referência

CVE-2026-8988

CVE-2026-8988HIGH

Access to Bootloader

41RIESGO

abrir ↗

Referência

CVE-2026-8982

CVE-2026-8982CRITICAL

Hard-coded / Backdoor Accounts

48RIESGO

abrir ↗

Referência

CVE-2016-20096

CVE-2016-20096CRITICAL

Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp

48RIESGO

abrir ↗

Referência

CVE-2026-16451

CVE-2026-16451MEDIUM

zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-64824

CVE-2026-64824CRITICAL

Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

48RIESGO

abrir ↗

Referência

CVE-2026-16450

CVE-2026-16450MEDIUM

zsadmin2025 ZS-Admin MyBatis-Plus Tenant Plugin page getTenantId authorization

33RIESGO

abrir ↗

Referência

CVE-2026-16449

CVE-2026-16449MEDIUM

zsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-16448

CVE-2026-16448MEDIUM

D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection

33RIESGO

abrir ↗

Referência

CVE-2026-16331

CVE-2026-16331MEDIUM

D-Link DNS-320 save_ajax.php unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-16330

CVE-2026-16330MEDIUM

D-Link DNS-320 uploadify.php unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-63770

CVE-2026-63770HIGH

Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass

41RIESGO

abrir ↗

Referência

CVE-2026-63771

CVE-2026-63771MEDIUM

Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header

33RIESGO

abrir ↗

Referência

CVE-2026-13402

CVE-2026-13402MEDIUM

Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-16015

CVE-2026-16015MEDIUM

poco-ai poco-claw executor_manager API tasks.py create_task missing authentication

33RIESGO

abrir ↗

Referência

CVE-2026-12869

CVE-2026-12869MEDIUM

Header Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template Import

33RIESGO

abrir ↗

Referência

CVE-2026-15907

CVE-2026-15907MEDIUM

H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-11579

CVE-2026-11579MEDIUM

Kali Forms < 2.4.17 - Unauthenticated Media Upload

33RIESGO

abrir ↗

Referência✓ VexDay Proof

XOOPS Module Amevents - SQL Injection

CVE-2008-5768—webappsphp

SQL injection vulnerability in print.php in the AM Events (aka Amevents) module 0.22 for XOOPS allows remote attackers t

23RIESGO

abrir ↗

Referência✓ VexDay Proof

PHP weather 2.2.2 - Local File Inclusion / Cross-Site Scripting

CVE-2008-5770—webappsphp

Cross-site scripting (XSS) vulnerability in config/make_config.php in PHP Weather 2.2.2 allows remote attackers to injec

23RIESGO

abrir ↗

Referência

CVE-2018-7297

CVE-2018-7297—

Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers

35RIESGO

abrir ↗

Referência

CVE-2018-7312

CVE-2018-7312—

SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.

23RIESGO

abrir ↗

Referência

CVE-2018-7313

CVE-2018-7313—

SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.

28RIESGO

abrir ↗

Referência

CVE-2018-7315

CVE-2018-7315—

SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, cast

23RIESGO

abrir ↗

Referência

CVE-2018-7358

CVE-2018-7358MEDIUM

ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper cha

55RIESGO

abrir ↗

Referência

CVE-2018-7448

CVE-2018-7448—

Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote

28RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.