Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.137exploits catalogados

35.961CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.458Referência 22.657GitHub PoC 14.424VulnCheck XDB 8773Nuclei 4340Metasploit 3485✓ solo verificadosrecientes populares riesgo

22.640 exploits

Referência

CVE-2026-7391

CVE-2026-7391MEDIUM

SourceCodester Pharmacy Sales and Inventory System ajax.php save_supplier sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-7390

CVE-2026-7390MEDIUM

SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-7389

CVE-2026-7389MEDIUM

EyouCMS common.php GetSortData sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-7388

CVE-2026-7388MEDIUM

EyouCMS Template File FilemanagerLogic.php editFile code injection

33RIESGO

abrir ↗

Referência

CVE-2026-76071

CVE-2026-76071CRITICAL

Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter

48RIESGO

abrir ↗

Referência★ 1

Original research and non-destructive PoC for a pre-auth stack buffer overflow via unbounded sscanf scanset in the Netis NC63 ipFilterList handler

CVE-2026-76071CRITICAL

Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter

48RIESGO

abrir ↗

Referência

CVE-2026-10152

CVE-2026-10152MEDIUM

TaleLin lin-cms-spring-boot book Endpoint BookController.java access control

33RIESGO

abrir ↗

Referência

CVE-2026-6000

CVE-2026-6000MEDIUM

code-projects Online Library Management System SQL Database Backup File library.sql information disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-5998

CVE-2026-5998MEDIUM

zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-5997

CVE-2026-5997CRITICAL

Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection

48RIESGO

abrir ↗

Referência

CVE-2026-5994

CVE-2026-5994CRITICAL

Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection

48RIESGO

abrir ↗

Referência

CVE-2026-5993

CVE-2026-5993CRITICAL

Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection

48RIESGO

abrir ↗

Referência

CVE-2026-5991

CVE-2026-5991HIGH

Tenda F451 WrlExtraSet formWrlExtraSet stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-5990

CVE-2026-5990HIGH

Tenda F451 SafeEmailFilter fromSafeEmailFilter stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-5989

CVE-2026-5989HIGH

Tenda F451 RouteStatic fromRouteStatic stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-5988

CVE-2026-5988HIGH

Tenda F451 AdvSetWrlsafeset formWrlsafeset stack-based overflow

41RIESGO

abrir ↗

Referência

CVE-2026-5987

CVE-2026-5987MEDIUM

Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine

33RIESGO

abrir ↗

Referência

CVE-2026-5986

CVE-2026-5986MEDIUM

Zod jsVideoUrlParser util.js getTime redos

33RIESGO

abrir ↗

Referência

CVE-2026-5985

CVE-2026-5985MEDIUM

code-projects Simple IT Discussion Forum crud.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2018-18419

CVE-2018-18419—

Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filen

23RIESGO

abrir ↗

Referência

CVE-2026-5453

CVE-2026-5453MEDIUM

Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key

33RIESGO

abrir ↗

Referência

CVE-2026-5452

CVE-2026-5452MEDIUM

UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key

33RIESGO

abrir ↗

Referência

CVE-2026-5420

CVE-2026-5420LOW

Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key

28RIESGO

abrir ↗

Referência

CVE-2026-5417

CVE-2026-5417MEDIUM

Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-5414

CVE-2026-5414MEDIUM

Newgen OmniDocs WebApiRequestRedirection resource injection

33RIESGO

abrir ↗

Referência

CVE-2026-5413

CVE-2026-5413MEDIUM

Newgen OmniDocs GetWebApiConfiguration information disclosure

33RIESGO

abrir ↗

Referência

CVE-2026-5370

CVE-2026-5370MEDIUM

krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-5368

CVE-2026-5368MEDIUM

projectworlds Car Rental Project Parameter login.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-5360

CVE-2026-5360MEDIUM

Free5GC aper type confusion

33RIESGO

abrir ↗

Referência

CVE-2026-5355

CVE-2026-5355MEDIUM

Trendnet TEW-657BRM setup.cgi vpn_drop os command injection

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.