Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.853exploits catalogados
39.383CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
25.447 exploits
Referência
CVE-2012-1153
Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote
50RIESGO
abrir ↗Referência
CVE-2020-11530
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in
60RIESGO
abrir ↗Referência
CVE-2022-41352
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through ama
100RIESGO
abrir ↗Referência
CVE-2026-7222
code-projects Coaching Management System Complaint Form complaint.php cross site scripting
33RIESGO
abrir ↗Referência
CVE-2019-11580
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attac
100RIESGO
abrir ↗Referência✓ VexDay Proof
VUPlayer 2.49 - '.asx' HREF Local Buffer Overflow (1)
Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in th
28RIESGO
abrir ↗Referência✓ VexDay Proof
VUPlayer 2.49 - '.asx' HREF Local Buffer Overflow (2)
Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in th
28RIESGO
abrir ↗Referência
CVE-2010-1876
SQL injection vulnerability in index.php in AJ Shopping Cart 1.0 allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗Referência
CVE-2023-5222
Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded password
70RIESGO
abrir ↗Referência✓ VexDay Proof
TutorialCMS 1.01 - Authentication Bypass
TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the
23RIESGO
abrir ↗Referência✓ VexDay Proof
IP Reg 0.4 - Blind SQL Injection
SQL injection vulnerability in login.php in IP Reg 0.4 and earlier allows remote attackers to execute arbitrary SQL comm
23RIESGO
abrir ↗Referência
CVE-2019-7609
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker
100RIESGO
abrir ↗Referência
CVE-2026-65711
sysPass 3.2.11 Authenticated OS Command Injection via Backup Path
41RIESGO
abrir ↗Referência
CVE-2026-15532
SourceCodester Online Book Store System User Management cross site scripting
33RIESGO
abrir ↗Referência✓ VexDay Proof
TROforum 0.1 - 'admin.php?site_url' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/admin.php in TROforum 0.1 allows remote attackers to execute arbitrary
35RIESGO
abrir ↗Referência✓ VexDay Proof
Rankem - File Disclosure / Cross-Site Scripting / Cookie
Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remot
23RIESGO
abrir ↗Referência
CVE-2026-17434
nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization
33RIESGO
abrir ↗Referência✓ VexDay Proof
Jadu Galaxies - 'categoryId' Blind SQL Injection
SQL injection vulnerability in scripts/documents.php in Jadu Galaxies allows remote attackers to execute arbitrary SQL c
23RIESGO
abrir ↗Referência✓ VexDay Proof
MatPo Link 1.2b - SQL Injection
SQL injection vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗Referência
CVE-2008-6609
Cross-site scripting (XSS) vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2 allows remote attackers to inject ar
23RIESGO
abrir ↗Referência✓ VexDay Proof
Wazzum Dating Software - 'userid' SQL Injection
SQL injection vulnerability in profile_view.php in Wazzum Dating Software, possibly 2.0, allows remote attackers to exec
23RIESGO
abrir ↗Referência✓ VexDay Proof
Script Toko Online 5.01 - SQL Injection
SQL injection vulnerability in shop_display_products.php in Script Toko Online 5.01 allows remote attackers to execute a
23RIESGO
abrir ↗Referência✓ VexDay Proof
ClickAuction - Authentication Bypass
SQL injection vulnerability in login_check.asp in ClickAuction allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗Referência✓ VexDay Proof
Pheap 2.0 - Authentication Bypass / Remote Code Execution
Pheap 2.0 allows remote attackers to bypass authentication by setting a pheap_login cookie value to the administrator's
23RIESGO
abrir ↗Referência✓ VexDay Proof
Ninja Blog 4.8 - Remote Information Disclosure
Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remo
23RIESGO
abrir ↗Referência✓ VexDay Proof
Macrovision FlexNet DownloadManager - Insecure Methods
Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.
28RIESGO
abrir ↗Referência
CVE-2011-3713
cFTP r80 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the
23RIESGO
abrir ↗Referência
CVE-2009-2235
SQL injection vulnerability in page.php in Your Articles Directory allows remote attackers to execute arbitrary SQL comm
23RIESGO
abrir ↗Referência✓ VexDay Proof
Bluo CMS 1.2 - Blind SQL Injection
SQL injection vulnerability in index.php in Bluo CMS 1.2 allows remote attackers to execute arbitrary SQL commands via t
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.