Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
85.883exploits catalogados
40.037CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.956Exploit-DB 24.488GitHub PoC 17.453VulnCheck XDB 9931Nuclei 4527Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.956 exploits
Referência
CVE-2021-27519
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "
38RIESGO
abrir ↗Referência✓ VexDay Proof
BuzzyWall 1.3.1 - 'id' Remote File Disclosure
Directory traversal vulnerability in download.php in BuzzyWall 1.3.1 allows remote attackers to read arbitrary local fil
23RIESGO
abrir ↗Referência
TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions
An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on so
23RIESGO
abrir ↗Referência
CVE-2010-3456
Directory traversal vulnerability in download.php in EnergyScripts (ES) Simple Download 1.0 allows remote attackers to r
23RIESGO
abrir ↗Referência✓ VexDay Proof
Pre Real Estate Listings - Arbitrary File Upload
Multiple SQL injection vulnerabilities in login.php in Pre Projects Pre Real Estate Listings allow remote attackers to e
23RIESGO
abrir ↗Referência
CVE-2010-0373
SQL injection vulnerability in the libros (com_libros) component for Joomla! allows remote attackers to execute arbitrar
23RIESGO
abrir ↗Referência✓ VexDay Proof
WordPress Plugin Enigma 2 Bridge - 'boarddir' Remote File Inclusion
PHP remote file inclusion vulnerability in the Enigma2 plugin (Enigma2.php) in Enigma WordPress Bridge allows remote att
53RIESGO
abrir ↗Referência
CVE-2026-13591
DeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation improper authorization
28RIESGO
abrir ↗Referência
CVE-2016-2279
Cross-site scripting (XSS) vulnerability in the web server in Rockwell Automation Allen-Bradley CompactLogix 1769-L* bef
33RIESGO
abrir ↗Referência
CVE-2026-112087
itsourcecode Online Cake Ordering System confirm.php sql injection
33RIESGO
abrir ↗Referência
CVE-2015-5074
Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php
23RIESGO
abrir ↗Referência
CVE-2011-4877
HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP,
23RIESGO
abrir ↗Referência
CVE-2016-7098
Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow
23RIESGO
abrir ↗Referência
CVE-2017-7037
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo
23RIESGO
abrir ↗Referência
CVE-2014-5370
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDra
23RIESGO
abrir ↗Referência
CVE-2014-5370
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDra
23RIESGO
abrir ↗Referência
CVE-2014-8949
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitr
23RIESGO
abrir ↗Referência
CVE-2015-5074
Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php
23RIESGO
abrir ↗Referência
CVE-2019-6279
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have an Incorrect Access Control vulnera
23RIESGO
abrir ↗Referência
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗Referência
CVE-2026-112086
ESPnet Inference Model inference_model.py build_model deserialization
33RIESGO
abrir ↗Referência
CVE-2026-9271
KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS
33RIESGO
abrir ↗Referência✓ VexDay Proof
eNdonesia 8.4 - '/mod.php/friend.php/admin.php' Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in eNdonesia 8.4 allow remote attackers to inject arbitrary web scri
23RIESGO
abrir ↗Referência
CVE-2017-14521
In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.
23RIESGO
abrir ↗Referência✓ VexDay Proof
MicroTik RouterOS 3.2 - SNMPd snmp-set Denial of Service
SNMPd in MikroTik RouterOS 3.2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a cra
23RIESGO
abrir ↗Referência
CVE-2014-4971
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RIESGO
abrir ↗Referência
CVE-2014-8555
Directory traversal vulnerability in report/reportViewAction.jsp in Progress Software OpenEdge 11.2 allows remote attack
23RIESGO
abrir ↗Referência
CVE-2016-4311
Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote at
23RIESGO
abrir ↗Referência
CVE-2017-0220
The Windows kernel in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows Server 2012 Gold allows authenticat
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.