Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.883exploits catalogados
40.037CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.956Exploit-DB 24.488GitHub PoC 17.453VulnCheck XDB 9931Nuclei 4527Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.956 exploits
Referência
CVE-2020-3118
CVE-2020-3118HIGHbajo ataque
Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability
76RIESGO
abrir ↗
Referência
CVE-2017-17739
CVE-2017-17739—
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html
28RIESGO
abrir ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6494—webappsasp
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/a
28RIESGO
abrir ↗
Referência
CVE-2019-8387
CVE-2019-8387—
MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.
35RIESGO
abrir ↗
Referência
CVE-2015-6912
CVE-2015-6912—
Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharact
28RIESGO
abrir ↗
Referência
CVE-2023-0159
CVE-2023-0159—
Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE
50RIESGO
abrir ↗
Referência
CVE-2018-8468
CVE-2018-8468—
An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows Elevation of Privil
28RIESGO
abrir ↗
Referência
CVE-2019-17132
CVE-2019-17132—
vBulletin through 5.5.4 mishandles custom avatars.
28RIESGO
abrir ↗
Referência
CVE-2026-80494
CVE-2026-80494HIGH
Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Backup Exec System Recovery Manager 7.0.1 - Arbitrary File Upload
CVE-2008-0457—remotewindows
Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, a
28RIESGO
abrir ↗
Referência✓ VexDay Proof
AspWebCalendar 2008 - Arbitrary File Upload
CVE-2008-2832—webappsasp
Unrestricted file upload vulnerability in calendar_admin.asp in Full Revolution aspWebCalendar 2008 allows remote attack
28RIESGO
abrir ↗
Referência
CVE-2012-3574
CVE-2012-3574—
Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6
28RIESGO
abrir ↗
Referência
CVE-2014-7279
CVE-2014-7279—
The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote attackers to obtain "equ
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Password Protector SD 1.3.1 - Insecure Cookie Handling
CVE-2009-2003—webappsphp
Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative acce
23RIESGO
abrir ↗
Referência
CVE-2019-9768
CVE-2019-9768—
Thinkst Canarytokens through commit hash 4e89ee0 (2019-03-01) relies on limited variation in size, metadata, and timesta
28RIESGO
abrir ↗
Referência
CVE-2026-78152
CVE-2026-78152MEDIUM
SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema
33RIESGO
abrir ↗
Referência
CVE-2009-4779
CVE-2009-4779—
Multiple PHP remote file inclusion vulnerabilities in NukeHall 0.3 and earlier allow remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2018-5724
CVE-2018-5724—
MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restore
28RIESGO
abrir ↗
Referência
CVE-2019-12744
CVE-2019-12744—
SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a differe
28RIESGO
abrir ↗
Referência
CVE-2019-12744
CVE-2019-12744—
SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a differe
28RIESGO
abrir ↗
Referência
CVE-2019-6273
CVE-2019-6273—
download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files.
28RIESGO
abrir ↗
Referência
CVE-2019-6273
CVE-2019-6273—
download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files.
28RIESGO
abrir ↗
Referência
CVE-2026-109930
CVE-2026-109930MEDIUM
MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key
33RIESGO
abrir ↗
Referência
CVE-2018-5724
CVE-2018-5724—
MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restore
28RIESGO
abrir ↗
Referência
CVE-2019-9768
CVE-2019-9768—
Thinkst Canarytokens through commit hash 4e89ee0 (2019-03-01) relies on limited variation in size, metadata, and timesta
28RIESGO
abrir ↗
Referência
CVE-2010-2716
CVE-2010-2716—
Multiple SQL injection vulnerabilities in PsNews 1.3 allow remote attackers to execute arbitrary SQL commands via the id
23RIESGO
abrir ↗
Referência
CVE-2010-2719
CVE-2010-2719—
SQL injection vulnerability in show.php in phpaaCms 0.3.1 UTF-8, and possibly other versions, allows remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2026-77753
CVE-2026-77753MEDIUM
Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords
33RIESGO
abrir ↗
Referência
CVE-2026-77689
CVE-2026-77689MEDIUM
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
33RIESGO
abrir ↗
Referência
CVE-2018-8947
CVE-2018-8947—
rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easi
28RIESGO
abrir ↗
← anteriorpágina 161 / 866siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.