Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
85.566exploits catalogados
39.907CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.846Exploit-DB 24.488GitHub PoC 17.314VulnCheck XDB 9877Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.846 exploits
Referência
CVE-2014-8499
Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Servi
50RIESGO
abrir ↗Referência
CVE-2026-16015
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗Referência✓ VexDay Proof
Techno Dreams Guestbook 1.0 - 'key' SQL Injection
SQL injection vulnerability in guestbookview.asp in Techno Dreams Guest Book 1.0 earlier allows remote attackers to exec
23RIESGO
abrir ↗Referência
CVE-2015-3124
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows
35RIESGO
abrir ↗Referência
CVE-2016-0801
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
35RIESGO
abrir ↗Referência✓ VexDay Proof
WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to e
23RIESGO
abrir ↗Referência
CVE-2017-5375
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. T
35RIESGO
abrir ↗Referência
CVE-2019-15813
Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arb
35RIESGO
abrir ↗Referência
CVE-2020-14871
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve
100RIESGO
abrir ↗Referência
CVE-2020-8195
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.1
75RIESGO
abrir ↗Referência✓ VexDay Proof
RevSense 1.0 - Authentication Bypass
SQL injection vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to execute arbitrary SQL comma
23RIESGO
abrir ↗Referência
CVE-2026-100304
TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
33RIESGO
abrir ↗Referência
CVE-2026-12907
RTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation
28RIESGO
abrir ↗Referência
CVE-2026-90509
dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials
33RIESGO
abrir ↗Referência✓ VexDay Proof
CFMBLOG - 'categorynbr' Blind SQL Injection
SQL injection vulnerability in index.cfm in CFMSource CFMBlog allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗Referência✓ VexDay Proof
Mambo Component SOBI2 RC 2.8.2 - SQL Injection
SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) RC 2.8.2 component for Joomla! and
23RIESGO
abrir ↗Referência✓ VexDay Proof
EgyPlus 7ml 1.0.1 - Authentication Bypass
Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quo
23RIESGO
abrir ↗Referência
CVE-2013-1306
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a cr
35RIESGO
abrir ↗Referência
CVE-2020-14871
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve
100RIESGO
abrir ↗Referência✓ VexDay Proof
Techno Dreams Announcement - 'key' SQL Injection
SQL injection vulnerability in MainAnnounce2.asp in Techno Dreams Announcement allows remote attackers to execute arbitr
23RIESGO
abrir ↗Referência
CVE-2017-6187
Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary c
50RIESGO
abrir ↗Referência
CVE-2018-19458
In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI UR
50RIESGO
abrir ↗Referência
CVE-2026-92366
code-projects Matrimonial System Regular Search search.php sql injection
33RIESGO
abrir ↗Referência
CVE-2009-2276
SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote atta
23RIESGO
abrir ↗Referência
CVE-2015-3337
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
50RIESGO
abrir ↗Referência
CVE-2015-8048
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and
35RIESGO
abrir ↗Referência
CVE-2016-4227
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RIESGO
abrir ↗Referência
CVE-2018-14716
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because reques
35RIESGO
abrir ↗Referência
CVE-2010-4321
Stack-based buffer overflow in an ActiveX control in ienipp.ocx in Novell iPrint Client 5.52 allows remote attackers to
50RIESGO
abrir ↗Referência
CVE-2022-40684
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.