Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.449exploits catalogados
35.552CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.451Referência 22.367GitHub PoC 14.225VulnCheck XDB 8649Nuclei 4283Metasploit 3474✓ solo verificadosrecientespopularesriesgo
22.332 exploits
Referência
CVE-2026-15749
CVE-2026-15749MEDIUM
mastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-58475
CVE-2026-58475MEDIUM
Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name
33RIESGO
abrir ↗
Referência
CVE-2026-11563
CVE-2026-11563CRITICAL
Word Count and Social Shares <= 1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal
48RIESGO
abrir ↗
Referência
CVE-2025-15665
CVE-2025-15665MEDIUM
BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field
33RIESGO
abrir ↗
Referência
CVE-2026-15622
CVE-2026-15622MEDIUM
poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization
33RIESGO
abrir ↗
Referência
CVE-2026-15622
CVE-2026-15622MEDIUM
poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization
33RIESGO
abrir ↗
Referência
CVE-2026-15620
CVE-2026-15620MEDIUM
mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-15619
CVE-2026-15619MEDIUM
mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-15607
CVE-2026-15607MEDIUM
tanstack db Alias Path select.ts select prototype pollution
33RIESGO
abrir ↗
Referência
CVE-2026-62239
CVE-2026-62239MEDIUM
FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
33RIESGO
abrir ↗
Referência
CVE-2026-15546
CVE-2026-15546MEDIUM
Shibby Tomato start_jffs2 sub_2D568 os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-15545
CVE-2026-15545HIGH
Shibby Tomato apcupsd tomatodata.cgi main out-of-bounds write
41RIESGO
abrir ↗
Referência
CVE-2026-15544
CVE-2026-15544HIGH
Shibby Tomato apcupsd tomatodata.cgi getupsvar stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-12397
CVE-2026-12397MEDIUM
WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-15535
CVE-2026-15535MEDIUM
AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization
33RIESGO
abrir ↗
Referência
CVE-2026-15531
CVE-2026-15531MEDIUM
yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization
33RIESGO
abrir ↗
Referência
CVE-2026-15530
CVE-2026-15530MEDIUM
WuzhiCMS Attachment API index.php listimage information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-15527
CVE-2026-15527MEDIUM
better-auth better-icons scan_project_icons/sync_icon path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-15526
CVE-2026-15526MEDIUM
augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-15525
CVE-2026-15525MEDIUM
kLOsk adloop write.py _validate_urls server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-15524
CVE-2026-15524MEDIUM
alioshr memory-bank-mcp list-project-files-validation-factory.ts path traversal
33RIESGO
abrir ↗
Referência✓ VexDay Proof
smeweb 1.4b - SQL Injection / Cross-Site Scripting
CVE-2008-2652—webappsphp
Multiple SQL injection vulnerabilities in catalog.php in SMEWeb 1.4b and 1.4f allow remote attackers to execute arbitrar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
pNews 2.08 - 'shownews' SQL Injection
CVE-2008-2673—webappsphp
SQL injection vulnerability in index.php in Powie pNews 2.08 and 2.10, when magic_quotes_gpc is disabled, allows remote
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component iJoomla! News Portal 1.0 - 'itemID' SQL Injection
CVE-2008-2676—webappsphp
SQL injection vulnerability in the iJoomla News Portal (com_news_portal) component 1.0 and earlier for Joomla! allows re
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Telephone Directory 2008 - SQL Injection / Cross-Site Scripting
CVE-2008-2677—webappsphp
Cross-site scripting (XSS) vulnerability in edit1.php in Telephone Directory 2008 allows remote attackers to inject arbi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
1Book Guestbook Script 1.0.1 - Code Execution
CVE-2008-2638—webappsphp
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
mebiblio 0.4.7 - SQL Injection / Arbitrary File Upload / Cross-Site Scripting
CVE-2008-2647—webappsphp
SQL injection vulnerability in admin/journal_change_mask.inc.php in meBiblio 0.4.7 allows remote attackers to execute ar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CMSimple 3.1 - Local File Inclusion / Arbitrary File Upload
CVE-2008-2650—webappsphp
Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote a
43RIESGO
abrir ↗
Referência✓ VexDay Proof
realm CMS 2.3 - Multiple Vulnerabilities
CVE-2008-2680—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in _db/compact.asp in Realm CMS 2.3 and earlier allow remote attacke
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Black Ice Software Inc Barcode SDK - 'BIDIB.ocx' Multiple Vulnerabilities
CVE-2008-2684—remotewindows
The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to exe
23RIESGO
abrir ↗
← anteriorpágina 482 / 745siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.