Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
82.877exploits catalogados
38.827CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 24.997Exploit-DB 24.485GitHub PoC 16.077VulnCheck XDB 9343Nuclei 4457Metasploit 3518✓ solo verificadosrecientespopularesriesgo
82.877 exploits
Exploit-DB✓ VexDay Proof
DirectAdmin 1.28/1.29 - 'CMD_TICKET' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DirectAdmin 1.28/1.29 - 'CMD_TICKET_CREATE' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DirectAdmin 1.28/1.29 - 'CMD_EMAIL_LIST' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ExoPHPDesk 1.2 - 'Pipe.php' Remote File Inclusion
PHP remote file inclusion vulnerability in pipe.php in Exophpdesk 1.2 allows remote attackers to execute arbitrary PHP c
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.x - '/wiki/list_pages.php?sort_mode' SQL Injection
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.x - '/wiki/orphan_pages.php?sort_mode' SQL Injection
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.x - '/fisheye/list_galleries.php?sort_mode' SQL Injection
Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbi
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.x - '/blogs/list_blogs.php?sort_mode' SQL Injection
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6/7 - XML Core Services Remote Code Execution (3)
Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Bitweaver 1.x - '/fisheye/index.php?sort_mode' SQL Injection
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6/7 - XML Core Services Remote Code Execution (2)
Unspecified vulnerability in the setRequestHeader method in the XMLHTTP (XML HTTP) ActiveX Control 4.0 in Microsoft XML
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
LetterIt 2.0 - 'session.php' Remote File Inclusion
PHP remote file inclusion vulnerability in inc/session.php for LetterIt 2 allows remote attackers to execute arbitrary P
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
bitweaver 1.x - '/newsletters/edition.php?tk' SQL Injection
SQL injection vulnerability in newsletters/edition.php in bitweaver 1.3.1 and earlier allows remote attackers to execute
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
LandShop 0.6.3 - 'ls.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in ls.php in SAMEDIA LandShop allow remote attackers to inject arbit
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
LandShop 0.6.3 - 'ls.php' Multiple SQL Injections
SQL injection vulnerability in ls.php in SAMEDIA LandShop allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.x - FPathConf System Call Local Denial of Service
The fpathconf syscall function in bsd/kern/kern_descrip.c in the Darwin kernel (XNU) 8.8.1 in Apple Mac OS X allows loca
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
FreeWebShop 2.1/2.2 - 'index.php?page' Traversal Arbitrary File Access
Directory traversal vulnerability in index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to read and incl
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Immediacy .NET CMS 5.2 - 'Logon.aspx' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in logon.aspx in Immediacy CMS (Immediacy .NET CMS) 5.2 allows remote attackers
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
FreeWebShop 2.1/2.2 - 'index.php?cat' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to inject
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Kayako SupportSuite 3.0.32 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Kayako SupportSuite 3.00.32 allows remote attackers to inject a
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
NewP News Publishing System 1.0 - 'Class.Database.php' Remote File Inclusion
PHP remote file inclusion vulnerability in lib/class.Database.php in NewP News Publication System 1.0.0, when register_g
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WarFTPd 1.82.00-RC11 - Remote Denial of Service
War FTP Daemon (WarFTPd) 1.82.00-RC11 allows remote authenticated users to cause a denial of service via a large number
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
IPManager 2.3 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Efficient IP iPmanager (IPm) 2.3 allows remote attackers to inj
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
@cid Stats 2.3 - 'Install.php3' Remote File Inclusion
PHP remote file inclusion vulnerability in install.php3 in @cid stats 2.3 allows remote attackers to execute arbitrary P
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
America Online ICQ 5.1 - ActiveX Control Remote Code Execution
The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
AIOCP 1.3.x - 'cp_links_search.php' SQL Injection
Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
AIOCP 1.3.x - 'cp_contact_us.php' SQL Injection
Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
AIOCP 1.3.x - 'cp_show_page_help.php' Full Path Disclosure
All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to obtain the full path of the web server v
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
AIOCP 1.3.x - 'load_page' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/code/index.php in All In One Control Panel (AIOCP) 1.3.007 and earlier
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
AIOCP 1.3.x - 'cp_show_ec_products.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.