Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.600exploits catalogados
39.734CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.742Exploit-DB 24.486GitHub PoC 16.618VulnCheck XDB 9736Nuclei 4493Metasploit 3525✓ solo verificadosrecientespopularesriesgo
5629 exploits
Referência✓ VexDay Proof
AGENCY4NET WEBFTP 1 - 'download2.php' File Disclosure
CVE-2008-0091—webappsphp
Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arb
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Wysi Wiki Wyg 1.0 - Local File Inclusion / Cross-Site Scripting / PHPInfo
CVE-2008-3205—webappsphp
Directory traversal vulnerability in index.php in Easy-Script Wysi Wiki Wyg 1.0 allows remote attackers to read arbitrar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
BbZL.php 0.92 - Insecure Cookie Handling
CVE-2008-4708—webappsphp
BbZL.PhP 0.92 allows remote attackers to bypass authentication and gain administrative access by setting the phorum_admi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
sCssBoard (Multiple Versions) - 'pwnpack' Remote s
CVE-2008-5576—webappsphp
admin/forums.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to bypass authentication and gain adminis
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CzarNews 1.14 - 'tpath' Remote File Inclusion
CVE-2006-3685—webappsphp
PHP remote file inclusion vulnerability in CzarNews 1.12 through 1.14 allows remote attackers to execute arbitrary PHP c
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpQuiz 0.1.2 - SQL Injection / Code Execution
CVE-2006-4979—webappsphp
Direct static code injection vulnerability in cfgphpquiz/install.php in Walter Beschmout PhpQuiz 1.2 and earlier allows
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpsyncml 0.1.2 - Remote File Inclusion
CVE-2007-4978—webappsphp
Multiple PHP remote file inclusion vulnerabilities in phpSyncML 0.1.2 and earlier allow remote attackers to execute arbi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
mutiple timesheets 5.0 - Multiple Vulnerabilities
CVE-2008-1415—webappsphp
Directory traversal vulnerability in index.php in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpinv 0.8.0 - Local File Inclusion / Cross-Site Scripting
CVE-2008-2694—webappsphp
Cross-site scripting (XSS) vulnerability in search.php in phpInv 0.8.0 allows remote attackers to inject arbitrary web s
23RIESGO
abrir ↗
Referência✓ VexDay Proof
NetRisk 2.0 - Cross-Site Scripting / SQL Injection
CVE-2008-4888—webappsphp
Cross-site scripting (XSS) vulnerability in error.php in NetRisk 2.0 and earlier allows remote attackers to inject arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
AvailScript Jobs Portal Script - (Authenticated) Arbitrary File Upload
CVE-2008-7021—webappsphp
Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated use
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Simple HTTPd 1.38 - Multiple Vulnerabilities
CVE-2007-6404—remotewindows
Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attac
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PowerNews 2.5.4 - 'newsid' SQL Injection
CVE-2009-0705—webappsphp
SQL injection vulnerability in news.php in PowerScripts PowerNews 2.5.4, when magic_quotes_gpc is disabled, allows remot
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Popcorn 1.87 - Remote Heap Overflow (PoC)
CVE-2009-1647—doswindows
Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of serv
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WordPress Plugin WP-Cal 0.3 - 'editevent.php' SQL Injection
CVE-2008-0490—webappsphp
SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WordPress Plugin Download - 'dl_id' SQL Injection
CVE-2008-1646—webappsphp
SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to ex
23RIESGO
abrir ↗
Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2981—webappsphp
PHP remote file inclusion vulnerability in admin/templates/template_thumbnail.php in HomePH Design 2.10 RC2, when regist
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MyForum 1.3 - Insecure Cookie Handling
CVE-2008-5040—webappsphp
Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1)
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Yaws < 1.80 - Multiple Headers Remote Denial of Service Vulnerabilities
CVE-2009-0751—dosmultiple
Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Sisfo Kampus 2006 - 'dwoprn.php?f' Arbitrary File Download
CVE-2007-4895—webappsphp
Directory traversal vulnerability in dwoprn.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
JShop 1.x < 2.x - 'xPage' Local File Inclusion
CVE-2008-1624—webappsphp
Directory traversal vulnerability in v2demo/page.php in Jshop Server 1.x through 2.x allows remote attackers to include
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ModernBill 4.4.x - Cross-Site Scripting / Remote File Inclusion
CVE-2008-5060—webappsphp
Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Company WebSite Builder PRO 1.9.8 - 'INCLUDE_PATH' Remote File Inclusion
CVE-2007-1513—webappsphp
PHP remote file inclusion vulnerability in comanda.php in GraFX Company WebSite Builder (CWB) PRO 1.9.8, when register_g
23RIESGO
abrir ↗
Referência✓ VexDay Proof
team 1.x - File Disclosure / Cross-Site Scripting
CVE-2009-0760—webappsasp
Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows re
23RIESGO
abrir ↗
Referência✓ VexDay Proof
RunCMS 1.6 - Multiple Vulnerabilities
CVE-2007-6546—webappsphp
RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a m
23RIESGO
abrir ↗
Referência✓ VexDay Proof
AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin
CVE-2008-2346—webappsphp
AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creat
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Tlnews 2.2 - Insecure Cookie Handling
CVE-2008-4752—webappsphp
TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login c
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpWebSite 0.10.0-full - 'topics.php' SQL Injection
CVE-2006-0973—webappsphp
SQL injection vulnerability in topics.php in Appalachian State University phpWebSite 0.10.2 and earlier allows remote at
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
CVE-2009-2159—webappsphp
backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote at
23RIESGO
abrir ↗
Referência✓ VexDay Proof
OPT Max 1.2.0 - 'CRM_inc' Remote File Inclusion
CVE-2006-4239—webappsphp
PHP remote file inclusion vulnerability in include/urights.php in Outreach Project Tool (OPT) Max 1.2.6 and earlier allo
23RIESGO
abrir ↗
← anteriorpágina 148 / 188siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.