Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

76.008exploits catalogados
34.638CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.443Referência 21.662GitHub PoC 13.743VulnCheck XDB 8460Nuclei 4233Metasploit 3467✓ solo verificadosrecientespopularesriesgo
21.662 exploits
Referência
CVE-2026-9385
CVE-2026-9385CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-9376
CVE-2026-9376MEDIUM
JPress UCenter Article Submission Endpoint doWriteSave improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-9372
CVE-2026-9372MEDIUM
ItzCrazyKns Vane Model Provider API route.ts server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-9371
CVE-2026-9371MEDIUM
ItzCrazyKns Vane API route.ts missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-9370
CVE-2026-9370MEDIUM
ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable salt
33RIESGO
abrir ↗
Referência
CVE-2026-9368
CVE-2026-9368MEDIUM
NousResearch hermes-agent Environment Variable code_execution_tool.py execute_code sandbox
33RIESGO
abrir ↗
Referência
CVE-2026-9367
CVE-2026-9367MEDIUM
NousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-9366
CVE-2026-9366MEDIUM
NousResearch hermes-agent prompt_builder.py _scan_context_content injection
33RIESGO
abrir ↗
Referência
CVE-2026-9365
CVE-2026-9365MEDIUM
Ettercap GG Dissector ec_gg.c FUNC_DECODER heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-9363
CVE-2026-9363MEDIUM
Edimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injection
33RIESGO
abrir ↗
Referência
CVE-2026-9362
CVE-2026-9362MEDIUM
Edimax EW-7438RPn Setting formConnectionSetting command injection
33RIESGO
abrir ↗
Referência
CVE-2026-9361
CVE-2026-9361MEDIUM
Edimax EW-7438RPn POST Request formAccep formAccept command injection
33RIESGO
abrir ↗
Referência
CVE-2026-8764
CVE-2026-8764HIGH
H3C Magic B3 aspForm UpdateWanParams buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2020-37244
CVE-2020-37244HIGH
WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx
41RIESGO
abrir ↗
Referência
CVE-2020-37243
CVE-2020-37243HIGH
WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS
41RIESGO
abrir ↗
Referência
CVE-2020-37242
CVE-2020-37242HIGH
WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx
41RIESGO
abrir ↗
Referência
CVE-2026-7678
CVE-2026-7678MEDIUM
YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7443
CVE-2026-7443MEDIUM
BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-7420
CVE-2026-7420HIGH
UTT HiPER 1250GW ConfigAdvideo strcpy buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2026-7419
CVE-2026-7419HIGH
UTT HiPER 1250GW formTaskEdit_ap strcpy buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2026-7418
CVE-2026-7418HIGH
UTT HiPER 1250GW NTP strcpy buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2026-7417
CVE-2026-7417MEDIUM
Algovate xhs-mcp MCP mcp.server.ts xhs_publish_content server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-7416
CVE-2026-7416MEDIUM
PolarVista xcode-mcp-server MCP index.ts run_tests os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-7410
CVE-2026-7410MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php add_to_cart sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7409
CVE-2026-7409MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php save_user sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
WordPress Plugin wp-Table 1.43 - 'inc_dir' Remote File Inclusion
CVE-2007-2484—webappsphp
PHP remote file inclusion vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress,
35RIESGO
abrir ↗
Referência✓ VexDay Proof
WordPress Plugin myflash 1.00 - 'wppath' Remote File Inclusion
CVE-2007-2485—webappsphp
PHP remote file inclusion vulnerability in myflash-button.php in the myflash 1.00 and earlier plugin for WordPress allow
35RIESGO
abrir ↗
Referência✓ VexDay Proof
PostNuke Module v4bJournal - SQL Injection
CVE-2007-2492—webappsphp
SQL injection vulnerability in index.php in the v4bJournal module for PostNuke allows remote authenticated users to exec
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Excel Viewer OCX 3.1.0.6 - Multiple Denial of Service Vulnerabilities
CVE-2007-2495—doswindows
Multiple stack-based buffer overflows in the ExcelOCX ActiveX control in ExcelViewer.ocx 3.1.0.6 allow remote attackers
23RIESGO
abrir ↗
Referência✓ VexDay Proof
1024 CMS 0.7 - 'download.php' Remote File Disclosure
CVE-2007-2507—webappsphp
Directory traversal vulnerability in includes/download.php in Treble Designs 1024 CMS 0.7 allows remote attackers to rea
23RIESGO
abrir ↗
← anteriorpágina 280 / 723siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.