Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência

CVE-2026-75876

CVE-2026-75876MEDIUM

xianrendzw EasyReport Move Operations ModuleController.java sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-75130

CVE-2026-75130MEDIUM

Context7 2.1.2 Prompt Injection via Custom AI Instructions

33RIESGO

abrir ↗

Referência

CVE-2026-19992

CVE-2026-19992LOW

Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure

28RIESGO

abrir ↗

Referência

CVE-2026-19972

CVE-2026-19972MEDIUM

itsourcecode Hospital Management System viewpatient.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-19964

CVE-2026-19964MEDIUM

Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection

33RIESGO

abrir ↗

Referência

CVE-2018-18798

CVE-2018-18798—

Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph

23RIESGO

abrir ↗

Referência

CVE-2026-18781

CVE-2026-18781HIGH

Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass

41RIESGO

abrir ↗

Referência

CVE-2018-18799

CVE-2018-18799—

School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.

23RIESGO

abrir ↗

Referência

CVE-2026-76987

CVE-2026-76987MEDIUM

liftoff-sr CIPster Generic Attribute Logic ciptypes.h SetAttrData memory corruption

33RIESGO

abrir ↗

Referência

CVE-2026-16058

CVE-2026-16058MEDIUM

YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration

33RIESGO

abrir ↗

Referência

CVE-2014-4977

CVE-2014-4977—

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute

60RIESGO

abrir ↗

Referência

CVE-2026-10223

CVE-2026-10223MEDIUM

NousResearch hermes-agent memory_tool.py _scan_memory_content injection

33RIESGO

abrir ↗

Referência

CVE-2026-67183

CVE-2026-67183HIGH

TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling

41RIESGO

abrir ↗

Referência

CVE-2019-1153

CVE-2019-1153MEDIUM

Microsoft Graphics Component Information Disclosure Vulnerability

33RIESGO

abrir ↗

Referência

CVE-2026-10204

CVE-2026-10204MEDIUM

OFCMS JSON Query SysUserController.java query sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-10189

CVE-2026-10189HIGH

Tenda W12 httpd cgiSysTimeInfoSet stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2018-25399

CVE-2018-25399HIGH

The Open ISES Project 3.30A SQL Injection via nearby.php

41RIESGO

abrir ↗

Referência

CVE-2026-10173

CVE-2026-10173MEDIUM

Orthanc Explorer 2 URL StudyList.vue cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2014-5074

CVE-2014-5074—

Siemens SIMATIC S7-1500 CPU devices with firmware before 1.6 allow remote attackers to cause a denial of service (device

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Persits XUpload 3.0 - 'AddFile()' Remote Buffer Overflow

CVE-2008-0492—remotewindows

Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUplo

43RIESGO

abrir ↗

Referência

CVE-2026-13605

CVE-2026-13605MEDIUM

Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute

33RIESGO

abrir ↗

Referência

CVE-2026-10127

CVE-2026-10127MEDIUM

Edimax BR-6478AC POST Request formStaDrvSetup command injection

33RIESGO

abrir ↗

Referência

CVE-2026-13423

CVE-2026-13423CRITICAL

Streamit < 4.5.2 - Unauthenticated Remote Code Execution via Arbitrary Function Call

48RIESGO

abrir ↗

Referência

CVE-2017-10661

CVE-2017-10661—

Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denia

28RIESGO

abrir ↗

Referência

CVE-2017-15957

CVE-2017-15957—

my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.

23RIESGO

abrir ↗

Referência

CVE-2017-15959

CVE-2017-15959—

Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-200

23RIESGO

abrir ↗

Referência

CVE-2026-18852

CVE-2026-18852MEDIUM

epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition

33RIESGO

abrir ↗

Referência

CVE-2026-18856

CVE-2026-18856MEDIUM

Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery

33RIESGO

abrir ↗

Referência

ManageEngine Service Desk 10.0 - Cross-Site Scripting

CVE-2019-15083—webappsjava

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workst

23RIESGO

abrir ↗

Referência

CVE-2017-15983

CVE-2017-15983—

MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.