Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
85.337exploits catalogados
39.873CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.822Exploit-DB 24.487GitHub PoC 17.115VulnCheck XDB 9874Nuclei 4511Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.822 exploits
Referência
CVE-2026-105383
onetwothreeneth HospitalManagementSystem controller.php sql injection
33RIESGO
abrir ↗Referência
CVE-2009-3421
login.php in Zenas PaoBacheca Guestbook 2.1, when register_globals is enabled, allows remote attackers to bypass authent
23RIESGO
abrir ↗Referência
CVE-2018-8898
A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B0
28RIESGO
abrir ↗Referência✓ VexDay Proof
PHPstore Wholesale - 'id' SQL Injection
SQL injection vulnerability in track.php in PHPStore Wholesales (aka Wholesale) allows remote attackers to execute arbit
23RIESGO
abrir ↗Referência
CVE-2016-8022
Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier)
28RIESGO
abrir ↗Referência
CVE-2010-5330
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the if
90RIESGO
abrir ↗Referência
CVE-2017-14495
Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote
45RIESGO
abrir ↗Referência
CVE-2022-25236
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace
60RIESGO
abrir ↗Referência✓ VexDay Proof
E-topbiz ADManager 4 - 'group' Blind SQL Injection
SQL injection vulnerability in view.php in E-topbiz AdManager 4 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗Referência✓ VexDay Proof
Magic News Pro 1.0.3 - 'script_path' Remote File Inclusion
PHP remote file inclusion vulnerability in scripts/news_page.php in Reamday Enterprises Magic News Pro 1.0.3 and earlier
23RIESGO
abrir ↗Referência
CVE-2014-8682
Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow r
50RIESGO
abrir ↗Referência
CVE-2015-1376
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remot
50RIESGO
abrir ↗Referência
CVE-2015-2995
The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote at
50RIESGO
abrir ↗Referência
CVE-2017-11281
Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploita
35RIESGO
abrir ↗Referência✓ VexDay Proof
SaturnCMS - Blind SQL Injection
SQL injection vulnerability in lib/user/t_user.php in SaturnCMS allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗Referência
CVE-2010-1342
Multiple PHP remote file inclusion vulnerabilities in Direct News 4.10.2, when register_globals is enabled, allow remote
23RIESGO
abrir ↗Referência
CVE-2017-11281
Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploita
35RIESGO
abrir ↗Referência✓ VexDay Proof
MDweb 1.3 - 'chemin_appli' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in MDweb 1.3 and earlier (Mdweb132-postgres) allow remote attackers t
23RIESGO
abrir ↗Referência
CVE-2010-5299
Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl f
50RIESGO
abrir ↗Referência
CVE-2014-8499
Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Servi
50RIESGO
abrir ↗Referência
CVE-2012-2925
SQL injection vulnerability in engine.php in Simple PHP Agenda 2.2.8 allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗Referência
CVE-2017-7588
On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a
35RIESGO
abrir ↗Referência
CVE-2015-0050
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memo
35RIESGO
abrir ↗Referência
CVE-2011-4885
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions pre
60RIESGO
abrir ↗Referência
CVE-2013-3111
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service
35RIESGO
abrir ↗Referência
CVE-2018-17552
SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigat
60RIESGO
abrir ↗Referência
CVE-2017-5375
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. T
35RIESGO
abrir ↗Referência
CVE-2010-4091
The EScript.api plugin in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.1, and 8.x before 8.2.6 on Windows
28RIESGO
abrir ↗Referência
CVE-2015-6131
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers t
35RIESGO
abrir ↗Referência
CVE-2019-12480
BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a
35RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.