Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.682exploits catalogados
39.953CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.887Exploit-DB 24.488GitHub PoC 17.378VulnCheck XDB 9888Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.887 exploits
Referência
CVE-2016-7866
CVE-2016-7866—
Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Successful exploitatio
28RIESGO
abrir ↗
Referência
CVE-2015-8352
CVE-2015-8352—
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files
28RIESGO
abrir ↗
Referência
CVE-2016-0793
CVE-2016-0793—
Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Se
28RIESGO
abrir ↗
Referência
CVE-2017-12965
CVE-2017-12965—
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
28RIESGO
abrir ↗
Referência
CVE-2017-6554
CVE-2017-6554—
pmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows remote attackers to wr
28RIESGO
abrir ↗
Referência✓ VexDay Proof
FaScript FaName 1.0 - SQL Injection
CVE-2008-0328—webappsphp
SQL injection vulnerability in page.php in FaScript FaName 1.0 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2018-8139
CVE-2018-8139—
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft
35RIESGO
abrir ↗
Referência
CVE-2019-3778
CVE-2019-3778—
Open Redirect in spring-security-oauth2
28RIESGO
abrir ↗
Referência
CVE-2020-25790
CVE-2020-25790—
Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archi
28RIESGO
abrir ↗
Referência
CVE-2025-44823
CVE-2025-44823CRITICAL
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagi
53RIESGO
abrir ↗
Referência
CVE-2026-108675
CVE-2026-108675MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop
33RIESGO
abrir ↗
Referência
CVE-2008-6104
CVE-2008-6104—
SQL injection vulnerability in A4Desk PHP Event Calendar allows remote attackers to execute arbitrary SQL commands via t
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Wireshark 1.0.6 - PN-DCP Format String (PoC)
CVE-2009-1210—dosmultiple
Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attacker
28RIESGO
abrir ↗
Referência
CVE-2015-2049
CVE-2015-2049—
Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated use
50RIESGO
abrir ↗
Referência
CVE-2020-35729
CVE-2020-35729—
KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.
60RIESGO
abrir ↗
Referência
CVE-2014-6437
CVE-2014-6437—
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configurat
28RIESGO
abrir ↗
Referência
CVE-2021-46354
CVE-2021-46354—
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vuln
28RIESGO
abrir ↗
Referência
CVE-2017-6554
CVE-2017-6554—
pmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows remote attackers to wr
28RIESGO
abrir ↗
Referência
CVE-2018-0933
CVE-2018-0933—
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution,
35RIESGO
abrir ↗
Referência
CVE-2018-10517
CVE-2018-10517—
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code ex
28RIESGO
abrir ↗
Referência
CVE-2018-5979
CVE-2018-5979—
SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.
28RIESGO
abrir ↗
Referência
CVE-2019-1151
CVE-2019-1151HIGH
Microsoft Graphics Remote Code Execution Vulnerability
46RIESGO
abrir ↗
Referência
CVE-2003-0831
CVE-2003-0831—
ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, whi
35RIESGO
abrir ↗
Referência
CVE-2026-108665
CVE-2026-108665MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit
33RIESGO
abrir ↗
Referência
CVE-2004-1423
CVE-2004-1423—
Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth o
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.3.13 - 'zip-notify' Remote Kernel Overflow (PoC)
CVE-2009-1236—dososx
Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and e
23RIESGO
abrir ↗
Referência
CVE-2009-2601
CVE-2009-2601—
SQL injection vulnerability in the Joomlaequipment (aka JUser or com_juser) component 2.0.4 for Joomla! allows remote at
23RIESGO
abrir ↗
Referência
CVE-2012-0874
CVE-2012-0874—
The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP)
28RIESGO
abrir ↗
Referência
CVE-2013-2751
CVE-2013-2751—
Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator
60RIESGO
abrir ↗
Referência
CVE-2018-0980
CVE-2018-0980—
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RIESGO
abrir ↗
← anteriorpágina 142 / 863siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.