Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.533exploits catalogados

35.607CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.455Referência 22.407GitHub PoC 14.247VulnCheck XDB 8663Nuclei 4287Metasploit 3474✓ solo verificadosrecientes populares riesgo

22.367 exploits

Referência

CVE-2026-9349

CVE-2026-9349MEDIUM

calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure

33RIESGO

abrir ↗

Referência

CVE-2018-25358

CVE-2018-25358HIGH

D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgi

41RIESGO

abrir ↗

Referência

CVE-2018-25356

CVE-2018-25356HIGH

SIPp 3.6 Local Buffer Overflow via Command-line Arguments

41RIESGO

abrir ↗

Referência

CVE-2018-25355

CVE-2018-25355HIGH

Audiograbber 1.83 Local Buffer Overflow via SEH

41RIESGO

abrir ↗

Referência

CVE-2018-25353

CVE-2018-25353HIGH

Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload

41RIESGO

abrir ↗

Referência

CVE-2018-25352

CVE-2018-25352HIGH

WordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_id

41RIESGO

abrir ↗

Referência

CVE-2018-25344

CVE-2018-25344HIGH

10-Strike Network Inventory Explorer 8.54 Buffer Overflow SEH

41RIESGO

abrir ↗

Referência

CVE-2018-25343

CVE-2018-25343MEDIUM

Smartshop 1 Cross-Site Request Forgery via editprofile.php

33RIESGO

abrir ↗

Referência

TeemIp IPAM < 2.4.0 - 'new_config' Command Injection (Metasploit)

CVE-2019-10863—remotephp

A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows on

28RIESGO

abrir ↗

Referência

CVE-2019-10893

CVE-2019-10893—

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to

23RIESGO

abrir ↗

Referência

D-Link DI-524 V2.06RU - Multiple Cross-Site Scripting

CVE-2019-11017—webappshardware

On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration:

23RIESGO

abrir ↗

Referência

CVE-2026-15540

CVE-2026-15540MEDIUM

SourceCodester Online Book Store System Administrative index.php php file inclusion

33RIESGO

abrir ↗

Referência

DirectAdmin 1.561 - Multiple Vulnerabilities

CVE-2019-11193—webappsphp

The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESE

23RIESGO

abrir ↗

Referência

CVE-2026-15699

CVE-2026-15699MEDIUM

spencermountain compromise Public Root API extend.js nlp.extend prototype pollution

33RIESGO

abrir ↗

Referência

CVE-2026-58477

CVE-2026-58477HIGH

Sustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP Parameters

41RIESGO

abrir ↗

Referência

CVE-2026-60114

CVE-2026-60114HIGH

Sustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup Restore

41RIESGO

abrir ↗

Referência

CVE-2026-15692

CVE-2026-15692HIGH

Tenda BE12 Pro SafeUrlFilter fromSafeUrlFilter stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-15691

CVE-2026-15691HIGH

Tenda BE12 Pro SafeClientFilter fromSafeClientFilter stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-15690

CVE-2026-15690LOW

open62541 Shared Client ua_client_connect.c responseReadNamespacesArray null pointer dereference

28RIESGO

abrir ↗

Referência

CVE-2026-15678

CVE-2026-15678MEDIUM

code-projects Online Job Portal DetailJob.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-15677

CVE-2026-15677MEDIUM

code-projects Online Job Portal JobSeekerInsert.php unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-15676

CVE-2026-15676MEDIUM

code-projects Online Job Portal DeleteUser.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-12988

CVE-2026-12988MEDIUM

WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding

33RIESGO

abrir ↗

Referência

CVE-2026-12583

CVE-2026-12583HIGH

Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field

41RIESGO

abrir ↗

Referência

CVE-2026-15675

CVE-2026-15675MEDIUM

code-projects Online Job Portal EditUser.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-15519

CVE-2026-15519LOW

usestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphere

28RIESGO

abrir ↗

Referência

CVE-2026-15194

CVE-2026-15194MEDIUM

Open5GS AMF context.c amf_context_final use after free

33RIESGO

abrir ↗

Referência

CVE-2026-15192

CVE-2026-15192MEDIUM

mettle sendportal APIv1 Webhooks mailjet missing authentication

33RIESGO

abrir ↗

Referência

CVE-2026-15191

CVE-2026-15191MEDIUM

mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization

33RIESGO

abrir ↗

Referência

CVE-2026-11827

CVE-2026-11827MEDIUM

Insufficiently Protected Credentials in GitLab

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.