Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.186exploits catalogados
40.156CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.041Exploit-DB 24.488GitHub PoC 17.609VulnCheck XDB 9976Nuclei 4542Metasploit 3530✓ solo verificadosrecientespopularesriesgo
26.041 exploits
Referência
CVE-2026-16290
CVE-2026-16290MEDIUM
ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Drupal 5.2 - PHP Zend Hash ation Vector
CVE-2007-5416—webappsphp
Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value m
23RIESGO
abrir ↗
Referência
CVE-2018-10257
CVE-2018-10257—
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile
23RIESGO
abrir ↗
Referência
CVE-2018-14327
CVE-2018-14327—
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before
23RIESGO
abrir ↗
Referência
CVE-2021-28418
CVE-2021-28418—
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and
23RIESGO
abrir ↗
Referência
CVE-2017-2533
CVE-2017-2533—
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "DiskArbitra
23RIESGO
abrir ↗
Referência
CVE-2023-23163
CVE-2023-23163—
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parame
23RIESGO
abrir ↗
Referência
CVE-2018-14327
CVE-2018-14327—
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before
23RIESGO
abrir ↗
Referência✓ VexDay Proof
S-CMS 1.1 Stable - Insecure Cookie Handling / Mass Page Delete
CVE-2009-0864—webappsphp
S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for t
23RIESGO
abrir ↗
Referência
CVE-2026-92475
CVE-2026-92475MEDIUM
GPAC downloader.c wait_for_header_and_parse out-of-bounds
33RIESGO
abrir ↗
Referência
CVE-2013-1408
CVE-2013-1408—
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenti
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ID Automation Linear Barcode - ActiveX Denial of Service
CVE-2007-2658—doswindows
Unspecified vulnerability in the ID Automation Linear Barcode 1.6.0.5 ActiveX control in IDAutomationLinear6.dll allows
23RIESGO
abrir ↗
Referência
CVE-2026-18583
CVE-2026-18583MEDIUM
mz-automation libiec61850 MMS Request mms_mapping.c checkDataSetAccess out-of-bounds
33RIESGO
abrir ↗
Referência
CVE-2014-3225
CVE-2014-3225—
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated us
23RIESGO
abrir ↗
Referência
CVE-2018-1002000
CVE-2018-1002000—
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require ad
23RIESGO
abrir ↗
Referência
CVE-2018-17784
CVE-2018-17784—
Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthentic
23RIESGO
abrir ↗
Referência
CVE-2020-8777
CVE-2020-8777—
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo,
23RIESGO
abrir ↗
Referência
CVE-2023-1826
CVE-2023-1826MEDIUM
SourceCodester Online Computer and Laptop Store index.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2013-1599
CVE-2013-1599—
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firm
35RIESGO
abrir ↗
Referência
CVE-2010-5026
CVE-2010-5026—
SQL injection vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to e
23RIESGO
abrir ↗
Referência
CVE-2013-1636
CVE-2013-1636—
Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP DB Designer 1.02 - Remote File Inclusion
CVE-2007-1620—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute
28RIESGO
abrir ↗
Referência
CVE-2014-3415
CVE-2014-3415—
SQL injection vulnerability in Sharetronix before 3.4 allows remote authenticated users to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2014-5380
CVE-2014-5380—
Grand MA 300 allows retrieval of the access PIN from sniffed data.
23RIESGO
abrir ↗
Referência
CVE-2026-13157
CVE-2026-13157HIGH
Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload
41RIESGO
abrir ↗
Referência
CVE-2017-6803
CVE-2017-6803—
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly
23RIESGO
abrir ↗
Referência
CVE-2026-15236
CVE-2026-15236HIGH
Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure
41RIESGO
abrir ↗
Referência
CVE-2019-0730
CVE-2019-0730—
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), ak
23RIESGO
abrir ↗
Referência
CVE-2011-4899
CVE-2011-4899—
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie
23RIESGO
abrir ↗
Referência
CVE-2019-14749
CVE-2019-14749—
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the ex
23RIESGO
abrir ↗
← anteriorpágina 210 / 869siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.