Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
85.566exploits catalogados
39.907CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.846Exploit-DB 24.488GitHub PoC 17.314VulnCheck XDB 9877Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.846 exploits
Referência
CVE-2018-7171
Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of a
28RIESGO
abrir ↗Referência
CVE-2012-2917
Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to
23RIESGO
abrir ↗Referência
CVE-2016-3324
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service
28RIESGO
abrir ↗Referência
CVE-2022-28079
College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.
43RIESGO
abrir ↗Referência
CVE-2013-6720
Directory traversal vulnerability in download.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX
28RIESGO
abrir ↗Referência✓ VexDay Proof
Active Membership 2 - Authentication Bypass
SQL injection vulnerability in account.asp in Active Membership 2.0 allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗Referência✓ VexDay Proof
living Local 1.1 - Cross-Site Scripting / Arbitrary File Upload
Cross-site scripting (XSS) vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inj
23RIESGO
abrir ↗Referência
CVE-2018-4063
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES4
76RIESGO
abrir ↗Referência✓ VexDay Proof
Campsite 3.3.0 RC1 - Multiple Remote File Inclusions
Cross-site scripting (XSS) vulnerability in admin-files/templates/list_dir.php in Campsite 3.3.0 RC1 allows remote attac
23RIESGO
abrir ↗Referência
CVE-2009-4200
SQL injection vulnerability in the Seminar (com_seminar) component 1.28 for Joomla! allows remote attackers to execute a
23RIESGO
abrir ↗Referência
CVE-2011-1137
Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a deni
28RIESGO
abrir ↗Referência
CVE-2019-11229
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
35RIESGO
abrir ↗Referência
CVE-2019-19356
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page.
76RIESGO
abrir ↗Referência✓ VexDay Proof
MyioSoft Ajax Portal 3.0 - Authentication Bypass
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to
23RIESGO
abrir ↗Referência✓ VexDay Proof
Joomla! Component Dada Mail Manager 2.6 - Remote File Inclusion
PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for
35RIESGO
abrir ↗Referência
CVE-2015-2521
Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to exec
28RIESGO
abrir ↗Referência
CVE-2015-7766
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
60RIESGO
abrir ↗Referência
CVE-2018-19571
GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an
35RIESGO
abrir ↗Referência
Persian VIP Download Script 1.0 - 'active' SQL Injection
Persian VIP Download Script 1.0 allows SQL Injection via the cart_edit.php active parameter.
23RIESGO
abrir ↗Referência
CVE-2009-2890
Cross-site scripting (XSS) vulnerability in results.php in PHP Scripts Now Riddles allows remote attackers to inject arb
23RIESGO
abrir ↗Referência
CVE-2026-111153
Game Music Emu (libgme) through 0.6.5 Out-of-Bounds Read via Classic_Emu::mute_voices_
33RIESGO
abrir ↗Referência
CVE-2013-3632
The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users
68RIESGO
abrir ↗Referência
CVE-2015-3036
Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in c
28RIESGO
abrir ↗Referência
CVE-2015-7766
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
60RIESGO
abrir ↗Referência
CVE-2022-40946
On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via t
41RIESGO
abrir ↗Referência
CVE-2026-101159
WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission
41RIESGO
abrir ↗Referência
CVE-2026-90818
netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery
33RIESGO
abrir ↗Referência
CVE-2026-90501
lenve vhr HrMapper.xml HrInfoController.updateHr privileges management
33RIESGO
abrir ↗Referência
CVE-2026-90500
lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload
33RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.