Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.055exploits catalogados
40.803CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.350VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2024-7083
CVE-2024-7083LOW
Email Encoder < 2.3.4 - Admin+ Stored XSS
28RIESGO
abrir ↗
Referência
CVE-2026-6610
CVE-2026-6610MEDIUM
liangliangyy DjangoBlog Setting settings.py hard-coded credentials
33RIESGO
abrir ↗
Referência
CVE-2026-6609
CVE-2026-6609MEDIUM
liangliangyy DjangoBlog views.py form_valid improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-6608
CVE-2026-6608MEDIUM
lm-sys fastchat Arena Side-by-Side View add_text control flow
33RIESGO
abrir ↗
Referência
CVE-2026-6607
CVE-2026-6607MEDIUM
lm-sys fastchat Worker API Endpoint api_generate resource consumption
33RIESGO
abrir ↗
Referência
CVE-2026-6606
CVE-2026-6606MEDIUM
modelscope agentscope _agent_base.py _process_audio_block server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-6605
CVE-2026-6605MEDIUM
modelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-6604
CVE-2026-6604MEDIUM
modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-6603
CVE-2026-6603MEDIUM
modelscope agentscope _python.py execute_shell_command code injection
33RIESGO
abrir ↗
Referência
CVE-2026-5719
CVE-2026-5719MEDIUM
itsourcecode Construction Management System borrowedtool.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-5692
CVE-2026-5692MEDIUM
Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection
33RIESGO
abrir ↗
Referência
CVE-2021-4473
CVE-2021-4473CRITICAL
Tianxin Internet Behavior Management System Command Injection via toQuery.php
48RIESGO
abrir ↗
Referência
CVE-2026-22666
CVE-2026-22666HIGH
Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
46RIESGO
abrir ↗
Referência
CVE-2026-4079
CVE-2026-4079MEDIUM
SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection
33RIESGO
abrir ↗
Referência
CVE-2026-1900
CVE-2026-1900MEDIUM
Link Whisper Free < 0.9.1 - Unauthenticated Settings and User Meta Update
33RIESGO
abrir ↗
Referência
CVE-2025-15611
CVE-2025-15611MEDIUM
Popup Box AYS Pro < 5.5.0 - Admin+ Stored Cross-Site Scripting (XSS) via CSRF
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Achievo 1.3.2 - 'FCKeditor' Arbitrary File Upload
CVE-2008-2742—webappsphp
Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/co
23RIESGO
abrir ↗
Referência
CVE-2016-4313
CVE-2016-4313—
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2018-6755
CVE-2018-6755HIGH
True Key (TK) Windows Client - Weak Directory Permission Vulnerability
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Black Ice Software Annotation Plugin - 'BiAnno.ocx' Remote Buffer Overflow (2)
CVE-2008-2745—remotewindows
Stack-based buffer overflow in BiAnno ActiveX Control (BiAnno.ocx) in Black Ice Software Annotation Plugin 10.95 allows
28RIESGO
abrir ↗
Referência
CVE-2011-0513
CVE-2011-0513—
DCR.sys driver in SecurStar DriveCrypt 5.4, 5.3, and earlier allows local users to execute arbitrary code via a crafted
23RIESGO
abrir ↗
Referência
CVE-2013-1465
CVE-2013-1465—
The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to un
23RIESGO
abrir ↗
Referência
CVE-2014-4960
CVE-2014-4960—
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x throu
23RIESGO
abrir ↗
Referência
CVE-2016-4793
CVE-2016-4793—
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP head
23RIESGO
abrir ↗
Referência
CVE-2013-1596
CVE-2013-1596—
An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP pac
28RIESGO
abrir ↗
Referência
CVE-2012-2584
CVE-2012-2584—
Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitr
23RIESGO
abrir ↗
Referência
CVE-2014-5275
CVE-2014-5275—
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote au
23RIESGO
abrir ↗
Referência
CVE-2026-19898
CVE-2026-19898MEDIUM
VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication
33RIESGO
abrir ↗
Referência
CVE-2026-19821
CVE-2026-19821HIGH
Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2014-5347
CVE-2014-5347—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress
23RIESGO
abrir ↗
← anteriorpágina 789 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.