Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
78.794exploits catalogados
36.057CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
24.459 exploits
Exploit-DB
Microsoft - NTLM Hash Disclosure Spoofing (library-ms)
NTLM Hash Disclosure Spoofing Vulnerability
75RIESGO
abrir ↗Exploit-DB
unzip-stream 0.3.1 - Arbitrary File Write
Arbitrary File Write via artifact extraction in actions/artifact
41RIESGO
abrir ↗Exploit-DB
tar-fs 3.0.0 - Arbitrary File Write/Overwrite
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted
41RIESGO
abrir ↗Exploit-DB
code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting (XSS)
code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" p
33RIESGO
abrir ↗Exploit-DB
FoxCMS 1.2.5 - Remote Code Execution (RCE)
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RIESGO
abrir ↗Exploit-DB
Apache Commons Text 1.10.0 - Remote Code Execution
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RIESGO
abrir ↗Exploit-DB
KiviCare Clinic & Patient Management System (EHR) 3.6.4 - Unauthenticated SQL Injection
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
61RIESGO
abrir ↗Exploit-DB
Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
75RIESGO
abrir ↗Exploit-DB
Inventio Lite 4 - SQL Injection
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action
48RIESGO
abrir ↗Exploit-DB
UJCMS 9.6.3 - User Enumeration via IDOR
Dromara UJCMS User ID id authorization
33RIESGO
abrir ↗Exploit-DB
Langflow 1.3.0 - Remote Code Execution (RCE)
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RIESGO
abrir ↗Exploit-DB
Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation
PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery
33RIESGO
abrir ↗Exploit-DB
TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption
TP-Link VN020 F3v(T) FTP USER Command memory corruption
33RIESGO
abrir ↗Exploit-DB
ABB Cylon Aspect 3.08.02 (deployStart.php) - Unauthenticated Command Execution
Unauthorized Access
48RIESGO
abrir ↗Exploit-DB
TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS)
TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service
41RIESGO
abrir ↗Exploit-DB
Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo
75RIESGO
abrir ↗Exploit-DB
compop.ca 3.5.3 - Arbitrary code Execution
An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and t
48RIESGO
abrir ↗Exploit-DB
Usermin 2.100 - Username Enumeration
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid
48RIESGO
abrir ↗Exploit-DB
Smart Manager 8.27.0 - Post-Authenticated SQL Injection
Smart Manager < 8.28.0 - Admin+ SQL Injection
41RIESGO
abrir ↗Exploit-DB
Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS)
Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.
41RIESGO
abrir ↗Exploit-DB
Dell EMC iDRAC7/iDRAC8 2.52.52.52 - Remote Code Execution (RCE)
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute
60RIESGO
abrir ↗Exploit-DB
phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
48RIESGO
abrir ↗Exploit-DB
Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowin
28RIESGO
abrir ↗Exploit-DB
WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection
WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection
41RIESGO
abrir ↗Exploit-DB
ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF)
Cross Side Request Forgery, CSRF
41RIESGO
abrir ↗Exploit-DB
WebMethods Integration Server 10.15.0.0000-0092 - Improper Access on Login Page
The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core
41RIESGO
abrir ↗Exploit-DB
Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RIESGO
abrir ↗Exploit-DB
Ethercreative Logs 3.0.3 - Path Traversal
The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in
28RIESGO
abrir ↗Exploit-DB
Car Rental Project 1.0 - Remote Code Execution
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile ima
23RIESGO
abrir ↗Exploit-DB
phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames
phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.