Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.566exploits catalogados
39.907CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.846Exploit-DB 24.488GitHub PoC 17.314VulnCheck XDB 9877Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.846 exploits
Referência
CVE-2015-2467
CVE-2015-2467—
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Offic
28RIESGO
abrir ↗
Referência
CVE-2009-2233
CVE-2009-2233—
The admin interface in AWScripts.com Gallery Search Engine 1.5 allows remote attackers to bypass authentication and gain
23RIESGO
abrir ↗
Referência
CVE-2015-7254
CVE-2015-7254—
Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary
28RIESGO
abrir ↗
Referência
CVE-2016-3388
CVE-2016-3388—
Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which al
28RIESGO
abrir ↗
Referência
CVE-2006-1236
CVE-2006-1236—
Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrar
28RIESGO
abrir ↗
Referência
CVE-2019-14322
CVE-2019-14322—
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
50RIESGO
abrir ↗
Referência
CVE-2024-5765
CVE-2024-5765CRITICAL
WpStickyBar <= 2.1.0 - Unauthenticated SQLi
68RIESGO
abrir ↗
Referência
CVE-2026-90499
CVE-2026-90499MEDIUM
lenve vhr Password Update pass HrInfoController.updatePass improper authorization
33RIESGO
abrir ↗
Referência
CVE-2020-14209
CVE-2020-14209—
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code executio
28RIESGO
abrir ↗
Referência
CVE-2017-1002000
CVE-2017-1002000—
Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-
28RIESGO
abrir ↗
Referência
CVE-2009-3976
CVE-2009-3976—
Buffer overflow in Labtam ProFTP 2.9 allows remote FTP servers to cause a denial of service (application crash) or execu
43RIESGO
abrir ↗
Referência✓ VexDay Proof
MyioSoft EasyCalendar - Authentication Bypass
CVE-2008-5654—webappsphp
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyCalendar 4.0 allows remote attackers t
23RIESGO
abrir ↗
Referência
CVE-2018-8733
CVE-2018-8733—
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an
43RIESGO
abrir ↗
Referência
CVE-2018-8733
CVE-2018-8733—
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an
43RIESGO
abrir ↗
Referência
CVE-2022-41358
CVE-2022-41358MEDIUM
A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Woltlab Burning Board 1.0.2/2.3.6 - 'search.php' SQL Injection (2)
CVE-2007-0388—webappsphp
SQL injection vulnerability in search.php in Woltlab Burning Board (wBB) 1.0.2 and earlier, and 2.3.6 and earlier in the
23RIESGO
abrir ↗
Referência
CVE-2022-20705
CVE-2022-20705CRITICAL
Cisco Small Business RV Series Routers Vulnerabilities
85RIESGO
abrir ↗
Referência
CVE-2019-0567
CVE-2019-0567—
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
45RIESGO
abrir ↗
Referência
CVE-2018-7750
CVE-2018-7750—
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x
28RIESGO
abrir ↗
Referência
CVE-2017-16562
CVE-2017-16562—
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers
28RIESGO
abrir ↗
Referência
CVE-2012-3137
CVE-2012-3137—
The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 all
35RIESGO
abrir ↗
Referência
Sahi pro 8.x - Directory Traversal
CVE-2019-13063—webappsmultiple
Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the sc
28RIESGO
abrir ↗
Referência
CVE-2013-3522
CVE-2013-3522—
SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier
43RIESGO
abrir ↗
Referência
CVE-2016-0985
CVE-2016-0985—
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on
28RIESGO
abrir ↗
Referência
CVE-2026-111140
CVE-2026-111140MEDIUM
libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data
33RIESGO
abrir ↗
Referência
CVE-2026-111139
CVE-2026-111139MEDIUM
NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask
33RIESGO
abrir ↗
Referência
CVE-2026-111138
CVE-2026-111138MEDIUM
NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read in RLE8 and RLE4 Decoders
33RIESGO
abrir ↗
Referência
CVE-2026-111232
CVE-2026-111232MEDIUM
Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
33RIESGO
abrir ↗
Referência✓ VexDay Proof
XOOPS Module xhresim - SQL Injection
CVE-2008-5665—webappsphp
SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2019-16405
CVE-2019-16405—
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code
28RIESGO
abrir ↗
← anteriorpágina 115 / 862siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.