Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.186exploits catalogados
40.156CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.041Exploit-DB 24.488GitHub PoC 17.609VulnCheck XDB 9976Nuclei 4542Metasploit 3530✓ solo verificadosrecientespopularesriesgo
26.041 exploits
Referência
CVE-2014-5370
CVE-2014-5370—
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDra
23RIESGO
abrir ↗
Referência
CVE-2014-8949
CVE-2014-8949—
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2015-5074
CVE-2015-5074—
Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php
23RIESGO
abrir ↗
Referência
CVE-2019-6279
CVE-2019-6279—
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have an Incorrect Access Control vulnera
23RIESGO
abrir ↗
Referência
CVE-2021-41773
CVE-2021-41773HIGHbajo ataqueransomware
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RIESGO
abrir ↗
Referência
CVE-2026-112087
CVE-2026-112087MEDIUM
itsourcecode Online Cake Ordering System confirm.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-9271
CVE-2026-9271MEDIUM
KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS
33RIESGO
abrir ↗
Referência✓ VexDay Proof
eNdonesia 8.4 - '/mod.php/friend.php/admin.php' Multiple Vulnerabilities
CVE-2006-6871—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in eNdonesia 8.4 allow remote attackers to inject arbitrary web scri
23RIESGO
abrir ↗
Referência
CVE-2014-9262
CVE-2014-9262—
The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files.
23RIESGO
abrir ↗
Referência
CVE-2025-2620
CVE-2025-2620CRITICAL
D-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflow
48RIESGO
abrir ↗
Referência
CVE-2015-2790
CVE-2015-2790—
Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1 allow remote attackers to cause a denial of service (memory c
28RIESGO
abrir ↗
Referência
CVE-2009-3315
CVE-2009-3315—
SQL injection vulnerability in admin/index.php in NeLogic Nephp Publisher Enterprise 3.5.9 and 4.5 allows remote attacke
23RIESGO
abrir ↗
Referência
CVE-2017-9936
CVE-2017-9936—
In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a
23RIESGO
abrir ↗
Referência
CVE-2018-20735
CVE-2018-20735—
An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for l
38RIESGO
abrir ↗
Referência
CVE-2020-5844
CVE-2020-5844—
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators t
35RIESGO
abrir ↗
Referência
CVE-2008-5753
CVE-2008-5753—
Stack-based buffer overflow in BulletProof FTP Client 2.63 and 2010 allows user-assisted attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2010-1951
CVE-2010-1951—
Multiple directory traversal vulnerabilities in 60cycleCMS allow remote attackers to include and execute arbitrary local
23RIESGO
abrir ↗
Referência
Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions
CVE-2023-31468HIGHlocalwindows
An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\I
41RIESGO
abrir ↗
Referência
CVE-2010-2124
CVE-2010-2124—
SQL injection vulnerability in firma.php in Bartels Schone ConPresso 4.0.7 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2026-106014
CVE-2026-106014MEDIUM
Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery
33RIESGO
abrir ↗
Referência
CVE-2026-89286
CVE-2026-89286MEDIUM
FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
33RIESGO
abrir ↗
Referência
CVE-2026-13524
CVE-2026-13524MEDIUM
CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-13485
CVE-2026-13485MEDIUM
SourceCodester Class and Exam Timetabling System preview.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-58049
CVE-2026-58049HIGH
FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Telekorn Signkorn Guestbook 1.3 - 'dir_path' Remote File Inclusion
CVE-2006-4788—webappsphp
PHP remote file inclusion vulnerability in includes/log.inc.php in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, whe
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Vz (Adp) Forum 2.0.3 - Remote Password Disclosure
CVE-2006-6891—webappsphp
Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remo
23RIESGO
abrir ↗
Referência
CVE-2017-14521
CVE-2017-14521—
In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.
23RIESGO
abrir ↗
Referência
CVE-2024-5655
CVE-2024-5655CRITICAL
Improper Access Control in GitLab
48RIESGO
abrir ↗
Referência✓ VexDay Proof
MicroTik RouterOS 3.2 - SNMPd snmp-set Denial of Service
CVE-2008-0680—doshardware
SNMPd in MikroTik RouterOS 3.2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a cra
23RIESGO
abrir ↗
Referência
CVE-2014-4971
CVE-2014-4971—
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RIESGO
abrir ↗
← anteriorpágina 206 / 869siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.