Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.566exploits catalogados
39.907CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.846Exploit-DB 24.488GitHub PoC 17.314VulnCheck XDB 9877Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.846 exploits
Referência
CVE-2026-92527
CVE-2026-92527MEDIUM
chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2015-3337
CVE-2015-3337—
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
50RIESGO
abrir ↗
Referência
CVE-2022-40684
CVE-2022-40684CRITICALbajo ataqueransomware
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RIESGO
abrir ↗
Referência
CVE-2008-2286
CVE-2008-2286—
SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allow
50RIESGO
abrir ↗
Referência
CVE-2017-2992
CVE-2017-2992—
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 h
35RIESGO
abrir ↗
Referência
CVE-2015-2525
CVE-2015-2525—
Task Scheduler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1
35RIESGO
abrir ↗
Referência✓ VexDay Proof
Professional Download Assistant 0.1 - Database Disclosure
CVE-2008-5572—webappsasp
Professional Download Assistant 0.1 stores sensitive information under the web root with insufficient access control, wh
23RIESGO
abrir ↗
Referência
CVE-2019-0235
CVE-2019-0235—
Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.
35RIESGO
abrir ↗
Referência
CVE-2023-3079
CVE-2023-3079HIGHbajo ataque
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corr
83RIESGO
abrir ↗
Referência
CVE-2023-3079
CVE-2023-3079HIGHbajo ataque
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corr
83RIESGO
abrir ↗
Referência
CVE-2026-14762
CVE-2026-14762MEDIUM
code-projects Hotel and Tourism Reservation Room Management rooms.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2015-5471
CVE-2015-5471—
Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allo
50RIESGO
abrir ↗
Referência
CVE-2017-3241
CVE-2017-3241—
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versi
35RIESGO
abrir ↗
Referência✓ VexDay Proof
Simple Customer 1.2 - Authentication Bypass
CVE-2008-6332—webappsphp
SQL injection vulnerability in login.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2026-14756
CVE-2026-14756MEDIUM
code-projects Hotel and Tourism Reservation Tour Management add_tour.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2020-14882
CVE-2020-14882CRITICALbajo ataque
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RIESGO
abrir ↗
Referência
CVE-2009-2308
CVE-2009-2308—
Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier fo
23RIESGO
abrir ↗
Referência
CVE-2009-2328
CVE-2009-2328—
admin/edit_user.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remot
23RIESGO
abrir ↗
Referência
CVE-2026-82421
CVE-2026-82421MEDIUM
itsourcecode Sales and Inventory System emp_edit.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2013-3143
CVE-2013-3143—
Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (mem
35RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPEasyData Pro 2.2.2 - 'index.php' SQL Injection
CVE-2006-5707—webappsphp
SQL injection vulnerability in index.php in PHPEasyData Pro 1.4.1 and 2.2.1 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2015-3134
CVE-2015-3134—
Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Social Groupie - 'id' SQL Injection
CVE-2008-6358—webappsphp
SQL injection vulnerability in group_index.php in Social Groupie allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2013-6935
CVE-2013-6935—
Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a
50RIESGO
abrir ↗
Referência
CVE-2015-2458
CVE-2015-2458—
ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,
35RIESGO
abrir ↗
Referência
CVE-2016-4229
CVE-2016-4229—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RIESGO
abrir ↗
Referência
CVE-2016-4229
CVE-2016-4229—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RIESGO
abrir ↗
Referência
CVE-2023-36874
CVE-2023-36874HIGHbajo ataque
Windows Error Reporting Service Elevation of Privilege Vulnerability
98RIESGO
abrir ↗
Referência
CVE-2018-15534
CVE-2018-15534—
Geutebrueck re_porter 16 before 7.8.974.20 has a possibility of unauthenticated access to sensitive information includin
35RIESGO
abrir ↗
Referência
CVE-2019-9792
CVE-2019-9792—
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during
28RIESGO
abrir ↗
← anteriorpágina 107 / 862siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.