Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
85.682exploits catalogados
39.953CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.887Exploit-DB 24.488GitHub PoC 17.378VulnCheck XDB 9888Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.887 exploits
Referência
CVE-2009-3971
SQL injection vulnerability in the jTips (com_jtips) component 1.0.7 and 1.0.9 for Joomla! allows remote attackers to ex
23RIESGO
abrir ↗Referência
CVE-2012-5877
Nero MediaHome 4.5.8.0 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and cr
23RIESGO
abrir ↗Referência
CVE-2014-8768
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow rem
28RIESGO
abrir ↗Referência
CVE-2014-8768
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow rem
28RIESGO
abrir ↗Referência
CVE-2018-9022
An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to exec
28RIESGO
abrir ↗Referência
CVE-2019-0573
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations,
28RIESGO
abrir ↗Referência
CVE-2018-13416
In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML Extern
28RIESGO
abrir ↗Referência
CVE-2018-5726
MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request,
28RIESGO
abrir ↗Referência✓ VexDay Proof
BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery
BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain
23RIESGO
abrir ↗Referência
CVE-2020-24881
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.
60RIESGO
abrir ↗Referência
CVE-2018-6006
SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.
28RIESGO
abrir ↗Referência
CVE-2021-24946
Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
60RIESGO
abrir ↗Referência
CVE-2026-49950
Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool
48RIESGO
abrir ↗Referência
CVE-2026-92463
yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing
41RIESGO
abrir ↗Referência
CVE-2015-5568
Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Ad
28RIESGO
abrir ↗Referência
CVE-2016-3387
Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which al
28RIESGO
abrir ↗Referência
CVE-2017-16921
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.2
28RIESGO
abrir ↗Referência
D-Link DIR-615 Wireless Router - Persistent Cross-Site Scripting
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.
28RIESGO
abrir ↗Referência✓ VexDay Proof
Maxum Rumpus 6.0 - Multiple Remote Buffer Overflow Vulnerabilities
Multiple buffer overflows in Rumpus before 6.0.1 allow remote attackers to (1) cause a denial of service (segmentation f
23RIESGO
abrir ↗Referência
CVE-2022-31161
Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload
68RIESGO
abrir ↗Referência
CVE-2026-108376
dataclasses-avroschema allows code injection through record names in generated default factories
41RIESGO
abrir ↗Referência
CVE-2026-110113
PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
33RIESGO
abrir ↗Referência
CVE-2010-3187
Buffer overflow in ftpd in IBM AIX 5.3 and earlier allows remote attackers to execute arbitrary code via a long NLST com
28RIESGO
abrir ↗Referência
CVE-2009-2439
Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrar
23RIESGO
abrir ↗Referência✓ VexDay Proof
bcoos 1.0.10 - Local File Inclusion / SQL Injection
SQL injection vulnerability in modules/banners/click.php in the banners module for bcoos 1.0.10 allows remote attackers
23RIESGO
abrir ↗Referência
CVE-2010-3187
Buffer overflow in ftpd in IBM AIX 5.3 and earlier allows remote attackers to execute arbitrary code via a long NLST com
28RIESGO
abrir ↗Referência
CVE-2013-1814
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain s
60RIESGO
abrir ↗Referência
CVE-2021-21148
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap
76RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.