Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.186exploits catalogados
40.156CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.041Exploit-DB 24.488GitHub PoC 17.609VulnCheck XDB 9976Nuclei 4542Metasploit 3530✓ solo verificadosrecientespopularesriesgo
26.041 exploits
Referência
CVE-2007-3806
CVE-2007-3806—
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbi
28RIESGO
abrir ↗
Referência
CVE-2026-12066
CVE-2026-12066MEDIUM
PbootCMS Password MemberController.php retrieve password recovery
33RIESGO
abrir ↗
Referência
CVE-2026-8589
CVE-2026-8589HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Motorola Timbuktu Pro 8.6.5/8.7 - Directory Traversal / Log Injection
CVE-2008-1117—remotewindows
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu P
50RIESGO
abrir ↗
Referência
CVE-2026-25860
CVE-2026-25860MEDIUM
OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler
33RIESGO
abrir ↗
Referência
CVE-2026-25860 POC git
CVE-2026-25860MEDIUM
OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler
33RIESGO
abrir ↗
Referência
CVE-2026-34417
CVE-2026-34417MEDIUM
OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php
33RIESGO
abrir ↗
Referência✓ VexDay Proof
AJ Article 1.0 - Remote Authentication Bypass
CVE-2008-7051—webappsphp
AJ Square AJ Article allows remote attackers to bypass authentication and access administrator functionality via a direc
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
CVE-2009-2157—webappsphp
Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2025-55651
CVE-2025-55651MEDIUM
A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows
33RIESGO
abrir ↗
Referência
CVE-2026-11582
CVE-2026-11582MEDIUM
CodeAstro Student Attendance Management System index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2012-1900
CVE-2012-1900—
Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2026-19723
CVE-2026-19723HIGH
Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler
41RIESGO
abrir ↗
Referência
CVE-2014-2579
CVE-2014-2579—
Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Microsoft Windows RSH daemon 1.7 - Remote Buffer Overflow
CVE-2007-4005—remotewindows
Stack-based buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 allows remote attackers to execute arbitrary co
28RIESGO
abrir ↗
Referência
CVE-2014-2587
CVE-2014-2587—
SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated user
23RIESGO
abrir ↗
Referência
CVE-2014-2623
CVE-2014-2623—
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
60RIESGO
abrir ↗
Referência✓ VexDay Proof
Confixx Pro 3.3.1 - 'saveserver.php' Remote File Inclusion
CVE-2007-4009—webappsphp
PHP remote file inclusion vulnerability in admin/business_inc/saveserver.php in SWSoft Confixx Pro 2.0.12 through 3.3.1
23RIESGO
abrir ↗
Referência✓ VexDay Proof
awzMB 4.2 Beta 1 - Multiple Remote File Inclusions
CVE-2007-5592—webappsphp
Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arb
28RIESGO
abrir ↗
Referência✓ VexDay Proof
phpMyNewsletter 0.8b5 - 'msg_id' SQL Injection
CVE-2008-1295—webappsphp
SQL injection vulnerability in archives.php in Gregory Kokanosky (aka Greg's Place) phpMyNewsletter 0.8 beta 5 and earli
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Nero ShowTime 5.0.15.0 - '.m3u' Playlist File Remote Buffer Overflow (PoC)
CVE-2008-7079—doswindows
Buffer overflow in Nero ShowTime 5.0.15.0 allows remote attackers to cause a denial of service (crash) and possibly exec
23RIESGO
abrir ↗
Referência
CVE-2011-1556
CVE-2011-1556—
SQL injection vulnerability in plugins/pdfClasses/pdfgen.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.4 allows remote a
23RIESGO
abrir ↗
Referência
CVE-2026-82914
CVE-2026-82914MEDIUM
kishan0725 Hospital-Management-System search.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2012-2592
CVE-2012-2592—
Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web scr
23RIESGO
abrir ↗
Referência
CVE-2012-2593
CVE-2012-2593—
Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote atta
23RIESGO
abrir ↗
Referência
CVE-2014-2994
CVE-2014-2994—
Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to exec
28RIESGO
abrir ↗
Referência
CVE-2014-2994
CVE-2014-2994—
Stack-based buffer overflow in Acunetix Web Vulnerability Scanner (WVS) 8 build 20120704 allows remote attackers to exec
28RIESGO
abrir ↗
Referência
CVE-2011-1565
CVE-2011-1565—
Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphica
50RIESGO
abrir ↗
Referência
CVE-2014-4971
CVE-2014-4971—
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RIESGO
abrir ↗
Referência
CVE-2014-3704
CVE-2014-3704—
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗
← anteriorpágina 203 / 869siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.