Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.165exploits catalogados

40.552CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.327Exploit-DB 24.488GitHub PoC 18.077VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.327 exploits

Referência

CVE-2026-6200

CVE-2026-6200HIGH

Tenda F456 webtypelibrary formwebtypelibrary stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-40043

CVE-2026-40043HIGH

Pachno 1.0.6 Authentication Bypass via runSwitchUser()

41RIESGO

abrir ↗

Referência

CVE-2016-8811

CVE-2016-8811—

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

23RIESGO

abrir ↗

Referência

CVE-2014-4511

CVE-2014-4511—

Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in

60RIESGO

abrir ↗

Referência

CVE-2015-1028

CVE-2015-1028—

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remo

23RIESGO

abrir ↗

Referência

CVE-2022-38580

CVE-2022-38580CRITICAL

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

53RIESGO

abrir ↗

Referência✓ VexDay Proof

GrapAgenda 0.1 - 'page' Remote File Inclusion

CVE-2006-4610—webappsphp

PHP remote file inclusion vulnerability in index.php in GrapAgenda 0.11 and earlier, when register_globals is enabled, a

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Danneo CMS 0.5.1 - Blind SQL Injection

CVE-2008-1513—webappsphp

SQL injection vulnerability in index.php in Danneo CMS 0.5.1 and earlier, when the Referers statistics option is enabled

23RIESGO

abrir ↗

Referência

CVE-2011-5277

CVE-2011-5277—

Multiple SQL injection vulnerabilities in signature.php in the Advanced Forum Signatures (aka afsignatures) plugin 2.0.4

23RIESGO

abrir ↗

Referência

CVE-2026-5854

CVE-2026-5854CRITICAL

Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection

53RIESGO

abrir ↗

Referência

CVE-2026-5853

CVE-2026-5853CRITICAL

Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection

53RIESGO

abrir ↗

Referência

CVE-2026-5852

CVE-2026-5852CRITICAL

Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection

53RIESGO

abrir ↗

Referência

CVE-2026-5851

CVE-2026-5851CRITICAL

Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection

53RIESGO

abrir ↗

Referência

CVE-2026-5850

CVE-2026-5850CRITICAL

Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection

53RIESGO

abrir ↗

Referência

CVE-2026-5849

CVE-2026-5849MEDIUM

Tenda i12 HTTP path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-5848

CVE-2026-5848MEDIUM

jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection

33RIESGO

abrir ↗

Referência

CVE-2026-23696

CVE-2026-23696CRITICAL

Windmill < 1.603.3 File Ownership Handling SQLi RCE

68RIESGO

abrir ↗

Referência

CVE-2026-23696

CVE-2026-23696CRITICAL

Windmill < 1.603.3 File Ownership Handling SQLi RCE

68RIESGO

abrir ↗

Referência

CVE-2026-22683

CVE-2026-22683HIGH

Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

56RIESGO

abrir ↗

Referência

CVE-2026-22683

CVE-2026-22683HIGH

Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

56RIESGO

abrir ↗

Referência

CVE-2018-25300

CVE-2018-25300HIGH

XATABoost CMS 1.0.0 SQL Injection via news.php

41RIESGO

abrir ↗

Referência

CVE-2026-33866

CVE-2026-33866MEDIUM

Authorization Bypass in MLflow AJAX Endpoint

33RIESGO

abrir ↗

Referência

CVE-2026-33865

CVE-2026-33865MEDIUM

Stored XSS via unsafe YAML parsing in MLflow

33RIESGO

abrir ↗

Referência

CVE-2026-22679

CVE-2026-22679CRITICAL

Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

53RIESGO

abrir ↗

Referência

CVE-2026-7392

CVE-2026-7392MEDIUM

SourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-7391

CVE-2026-7391MEDIUM

SourceCodester Pharmacy Sales and Inventory System ajax.php save_supplier sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-7390

CVE-2026-7390MEDIUM

SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-7389

CVE-2026-7389MEDIUM

EyouCMS common.php GetSortData sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-7388

CVE-2026-7388MEDIUM

EyouCMS Template File FilemanagerLogic.php editFile code injection

33RIESGO

abrir ↗

Referência✓ VexDay Proof

Neat weblog 0.2 - 'articleId' SQL Injection

CVE-2008-1639—webappsphp

SQL injection vulnerability in index.php in Neat weblog 0.2 allows remote attackers to execute arbitrary SQL commands vi

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.