Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados

40.804CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência

CVE-2026-5326

CVE-2026-5326MEDIUM

SourceCodester Leave Application System User Information index.php authorization

33RIESGO

abrir ↗

Referência

CVE-2026-5325

CVE-2026-5325MEDIUM

SourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-5259

CVE-2026-5259MEDIUM

AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-5258

CVE-2026-5258MEDIUM

Sanster IOPaint File Manager file_manager.py _get_file path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-5257

CVE-2026-5257MEDIUM

code-projects Simple Laundry System Parameter delstaffinfo.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-5256

CVE-2026-5256MEDIUM

code-projects Simple Laundry System Parameter modify.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-2696

CVE-2026-2696MEDIUM

Export All URLs < 5.1 - Unauthenticated Sensitive Data Exposure

33RIESGO

abrir ↗

Referência

CVE-2026-5153

CVE-2026-5153MEDIUM

Tenda CH22 WriteFacMac FormWriteFacMac command injection

33RIESGO

abrir ↗

Referência

CVE-2026-5152

CVE-2026-5152HIGH

Tenda CH22 createFileName formCreateFileName stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-5150

CVE-2026-5150MEDIUM

code-projects Accounting System Parameter viewin_costumer.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-5148

CVE-2026-5148MEDIUM

YunaiV yudao-cloud page sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-5147

CVE-2026-5147MEDIUM

YunaiV yudao-cloud get-by-website sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-5126

CVE-2026-5126MEDIUM

SourceCodester RSS Feed Parser file_get_contents server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-5125

CVE-2026-5125MEDIUM

raine consult-llm-mcp server.ts child_process.execSync os command injection

33RIESGO

abrir ↗

Referência

CVE-2019-25655

CVE-2019-25655MEDIUM

Device Monitoring Studio 8.10.00.8925 Denial of Service

33RIESGO

abrir ↗

Referência

CVE-2019-25654

CVE-2019-25654HIGH

Core FTP/SFTP Server 1.2 Denial of Service via Buffer Overflow

41RIESGO

abrir ↗

Referência

CVE-2019-25653

CVE-2019-25653MEDIUM

Navicat for Oracle 12.1.15 Password Field Denial of Service

33RIESGO

abrir ↗

Referência

CVE-2018-8732

CVE-2018-8732—

Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or H

23RIESGO

abrir ↗

Referência

CVE-2026-18357

CVE-2026-18357HIGH

WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure

41RIESGO

abrir ↗

Referência✓ VexDay Proof

Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery

CVE-2008-3332—webappsphp

Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administrators to

23RIESGO

abrir ↗

Referência

CVE-2026-94037

CVE-2026-94037MEDIUM

00Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-14844

CVE-2026-14844MEDIUM

Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes

33RIESGO

abrir ↗

Referência

CVE-2012-3810

CVE-2012-3810—

Samsung Kies before 2.5.0.12094_27_11 has registry modification.

23RIESGO

abrir ↗

Referência

CVE-2026-93959

CVE-2026-93959MEDIUM

SourceCodester Online Reviewer Management System btn_functions.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-92425

CVE-2026-92425MEDIUM

Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR

33RIESGO

abrir ↗

Referência

CVE-2013-2619

CVE-2013-2619—

Directory traversal vulnerability in Aspen before 0.22 allows remote attackers to read arbitrary files via a .. (dot dot

23RIESGO

abrir ↗

Referência✓ VexDay Proof

SunLight CMS 5.3 - 'root' Remote File Inclusion

CVE-2007-2774—webappsphp

Multiple PHP remote file inclusion vulnerabilities in SunLight CMS 5.3 allow remote attackers to execute arbitrary PHP c

23RIESGO

abrir ↗

Referência✓ VexDay Proof

SanyBee Gallery 0.1.1 - 'p' Local File Inclusion

CVE-2007-6648—webappsphp

Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and

23RIESGO

abrir ↗

Referência

CVE-2013-5028

CVE-2013-5028—

SQL injection vulnerability in IT/hardware-list.dll in Kwoksys Kwok Information Server before 2.8.5 allows remote authen

23RIESGO

abrir ↗

Referência✓ VexDay Proof

XRms 1.99.2 - Remote File Inclusion / Cross-Site Scripting / Information Gathering

CVE-2008-3398—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web sc

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.