Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

76.087exploits catalogados
34.679CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.443Referência 21.692GitHub PoC 13.792VulnCheck XDB 8460Nuclei 4233Metasploit 3467✓ solo verificadosrecientespopularesriesgo
21.692 exploits
Referência
CVE-2026-7155
CVE-2026-7155CRITICAL
Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7154
CVE-2026-7154CRITICAL
Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7153
CVE-2026-7153CRITICAL
Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7152
CVE-2026-7152CRITICAL
Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection
48RIESGO
abrir ↗
Referência
CVE-2026-7151
CVE-2026-7151HIGH
Tenda HG3 formIPv6Routing formUploadConfig stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-7150
CVE-2026-7150MEDIUM
dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-7149
CVE-2026-7149MEDIUM
dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7148
CVE-2026-7148MEDIUM
CodeAstro Online Classroom addnewfaculty sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7147
CVE-2026-7147MEDIUM
JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-5484
CVE-2026-5484MEDIUM
BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control
33RIESGO
abrir ↗
Referência
CVE-2026-5323
CVE-2026-5323MEDIUM
priyankark a11y-mcp index.js A11yServer server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-1540
CVE-2026-1540HIGH
Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution
41RIESGO
abrir ↗
Referência
CVE-2026-5322
CVE-2026-5322MEDIUM
AlejandroArciniegas mcp-data-vis MCP server.js request sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-5321
CVE-2026-5321MEDIUM
vanna-ai vanna FastAPI/Flask Server cross-domain policy
33RIESGO
abrir ↗
Referência
CVE-2026-5320
CVE-2026-5320MEDIUM
vanna-ai vanna Chat API Endpoint v2 missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-5319
CVE-2026-5319MEDIUM
itsourcecode Payroll Management System navbar.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-5318
CVE-2026-5318MEDIUM
LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write
33RIESGO
abrir ↗
Referência
CVE-2026-5317
CVE-2026-5317MEDIUM
Nothings stb stb_vorbis.c start_decoder out-of-bounds write
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Mole Group Last Minute Script 4.0 - SQL Injection
CVE-2008-3125—webappsphp
SQL injection vulnerability in index.php in Mole Group Lastminute Script 4.0 allows remote attackers to execute arbitrar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Multiple SQL Injections
CVE-2008-3129—webappsphp
Multiple SQL injection vulnerabilities in index.php in Catviz 0.4 beta 1 allow remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2026-1879
CVE-2026-1879MEDIUM
Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-5261
CVE-2026-5261MEDIUM
Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2025-15484
CVE-2025-15484CRITICAL
Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass
48RIESGO
abrir ↗
Referência
CVE-2026-5255
CVE-2026-5255MEDIUM
code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-5254
CVE-2026-5254MEDIUM
welovemedia FFmate Webhook AppJsonTreeView.vue cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-5253
CVE-2026-5253MEDIUM
bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-5252
CVE-2026-5252MEDIUM
z-9527 admin Message Create Endpoint message.js cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-5251
CVE-2026-5251MEDIUM
z-9527 admin User Update Endpoint user.js dynamically-determined object attributes
33RIESGO
abrir ↗
Referência
CVE-2026-5249
CVE-2026-5249MEDIUM
gougucms Record Endpoint record.html cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-5248
CVE-2026-5248MEDIUM
gougucms User Registration Login.php reg_submit dynamically-determined object attributes
33RIESGO
abrir ↗
← anteriorpágina 284 / 724siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.