Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.324exploits catalogados

36.054CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.458Referência 22.721GitHub PoC 14.477VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientes populares riesgo

22.721 exploits

Referência

CVE-2026-14647

CVE-2026-14647MEDIUM

onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds

33RIESGO

abrir ↗

Referência

CVE-2026-58453

CVE-2026-58453CRITICAL

JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials via anyka_ipc

48RIESGO

abrir ↗

Referência

CVE-2026-13567

CVE-2026-13567MEDIUM

code-projects Online Music Site POST Request Feedback.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-40524

CVE-2026-40524HIGH

FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()

41RIESGO

abrir ↗

Referência

CVE-2026-13561

CVE-2026-13561MEDIUM

Edimax EW-7478APC POST Request formiNICbasic os command injection

33RIESGO

abrir ↗

Referência✓ VexDay Proof

osTicket 1.11 - Cross-Site Scripting / Local File Inclusion

CVE-2019-11537—webappsphp

In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.ph

23RIESGO

abrir ↗

Referência

CVE-2019-1153

CVE-2019-1153MEDIUM

Microsoft Graphics Component Information Disclosure Vulnerability

33RIESGO

abrir ↗

Referência

CVE-2019-11539

CVE-2019-11539HIGHbajo ataqueransomware

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R

100RIESGO

abrir ↗

Referência

CVE-2026-13549

CVE-2026-13549MEDIUM

CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization

33RIESGO

abrir ↗

Referência

CVE-2026-5484

CVE-2026-5484MEDIUM

BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control

33RIESGO

abrir ↗

Referência

CVE-2026-5323

CVE-2026-5323MEDIUM

priyankark a11y-mcp index.js A11yServer server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-1540

CVE-2026-1540HIGH

Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution

41RIESGO

abrir ↗

Referência

CVE-2026-5322

CVE-2026-5322MEDIUM

AlejandroArciniegas mcp-data-vis MCP server.js request sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-5321

CVE-2026-5321MEDIUM

vanna-ai vanna FastAPI/Flask Server cross-domain policy

33RIESGO

abrir ↗

Referência

CVE-2026-5320

CVE-2026-5320MEDIUM

vanna-ai vanna Chat API Endpoint v2 missing authentication

33RIESGO

abrir ↗

Referência

CVE-2026-5319

CVE-2026-5319MEDIUM

itsourcecode Payroll Management System navbar.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-5318

CVE-2026-5318MEDIUM

LibRaw JPEG DHT losslessjpeg.cpp initval out-of-bounds write

33RIESGO

abrir ↗

Referência

CVE-2026-5317

CVE-2026-5317MEDIUM

Nothings stb stb_vorbis.c start_decoder out-of-bounds write

33RIESGO

abrir ↗

Referência

CVE-2026-1879

CVE-2026-1879MEDIUM

Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-5261

CVE-2026-5261MEDIUM

Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2025-15484

CVE-2025-15484CRITICAL

Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass

48RIESGO

abrir ↗

Referência

CVE-2026-5255

CVE-2026-5255MEDIUM

code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-5254

CVE-2026-5254MEDIUM

welovemedia FFmate Webhook AppJsonTreeView.vue cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-5253

CVE-2026-5253MEDIUM

bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-5252

CVE-2026-5252MEDIUM

z-9527 admin Message Create Endpoint message.js cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-5251

CVE-2026-5251MEDIUM

z-9527 admin User Update Endpoint user.js dynamically-determined object attributes

33RIESGO

abrir ↗

Referência

CVE-2026-5249

CVE-2026-5249MEDIUM

gougucms Record Endpoint record.html cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-5248

CVE-2026-5248MEDIUM

gougucms User Registration Login.php reg_submit dynamically-determined object attributes

33RIESGO

abrir ↗

Referência

CVE-2026-35057

CVE-2026-35057MEDIUM

XenForo Stored Cross-Site Scripting via Structured Text Mentions

33RIESGO

abrir ↗

Referência

CVE-2026-79845

CVE-2026-79845MEDIUM

code-projects Simple Inventory System edit.php sql injection

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.