Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.388exploits catalogados
40.212CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 9990Nuclei 4547Metasploit 3531✓ solo verificadosrecientespopularesriesgo
26.070 exploits
Referência
CVE-2026-63080
CVE-2026-63080HIGH
Aptabase SQL Injection via ClickHouse query backend
41RIESGO
abrir ↗
Referência
CVE-2017-13262
CVE-2017-13262—
In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing length decrement operation. Th
23RIESGO
abrir ↗
Referência
CVE-2026-12592
CVE-2026-12592HIGH
SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header
41RIESGO
abrir ↗
Referência✓ VexDay Proof
HIOX Banner Rotator 1.3 - 'hm' Remote File Inclusion
CVE-2008-3127—webappsphp
PHP remote file inclusion vulnerability in hioxBannerRotate.php in HIOX Banner Rotator (HBR) 1.3, when register_globals
23RIESGO
abrir ↗
Referência
CVE-2017-15970
CVE-2017-15970—
PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-16217
CVE-2026-16217MEDIUM
guohongze adminset Delivery Deployment Endpoint deli.py authorization
33RIESGO
abrir ↗
Referência
CVE-2017-17627
CVE-2017-17627—
Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-79793
CVE-2026-79793MEDIUM
code-projects Online Shopping System sumit_form.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2021-27308
CVE-2021-27308—
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to in
23RIESGO
abrir ↗
Referência
CVE-2026-86159
CVE-2026-86159MEDIUM
SourceCodester Online Voting System ajax.php save_user sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Micro CMS 0.3.5 - Remote Add/Delete/Password Change
CVE-2008-6553—webappsphp
microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an
23RIESGO
abrir ↗
Referência
CVE-2012-2629
CVE-2012-2629—
Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier all
23RIESGO
abrir ↗
Referência
CVE-2017-13262
CVE-2017-13262—
In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing length decrement operation. Th
23RIESGO
abrir ↗
Referência
CVE-2017-15970
CVE-2017-15970—
PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.
23RIESGO
abrir ↗
Referência
CVE-2009-3171
CVE-2009-3171—
Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2017-17627
CVE-2017-17627—
Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-16211
CVE-2026-16211LOW
allegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race condition
28RIESGO
abrir ↗
Referência✓ VexDay Proof
GeekLog 2.x - 'ImageImageMagick.php' Remote File Inclusion
CVE-2007-2793—webappsphp
PHP remote file inclusion vulnerability in ImageImageMagick.php in Geeklog 2.x allows remote attackers to execute arbitr
35RIESGO
abrir ↗
Referência
CVE-2026-16216
CVE-2026-16216MEDIUM
geex-arts django-jet OAuth cross-site request forgery
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Free MP3 CD Ripper 2.6 - '.wma' Local Buffer Overflow (SEH)
CVE-2019-9767—localwindows_x86
Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2022-41912
CVE-2022-41912CRITICAL
crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements
48RIESGO
abrir ↗
Referência
CVE-2008-2190
CVE-2008-2190—
SQL injection vulnerability in index.php in Online Rent (aka Online Rental Property Script) 4.5 and earlier allows remot
23RIESGO
abrir ↗
Referência
CVE-2015-5353
CVE-2015-5353—
Directory traversal vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to include and execute arbitrary lo
23RIESGO
abrir ↗
Referência
CVE-2015-8255
CVE-2015-8255—
AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi.
23RIESGO
abrir ↗
Referência
CVE-2016-7612
CVE-2016-7612—
An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchO
23RIESGO
abrir ↗
Referência
CVE-2017-14619
CVE-2017-14619—
Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web scrip
23RIESGO
abrir ↗
Referência
CVE-2018-11512
CVE-2018-11512—
Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "Ge
23RIESGO
abrir ↗
Referência
CVE-2023-27350
CVE-2023-27350CRITICALbajo ataqueransomware
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui
100RIESGO
abrir ↗
Referência✓ VexDay Proof
ImperialBB 2.3.5 - Arbitrary File Upload
CVE-2008-3093—webappsphp
Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and e
23RIESGO
abrir ↗
Referência
CVE-2022-4693
CVE-2022-4693CRITICAL
User Verification < 1.0.94 - Authentication Bypass
48RIESGO
abrir ↗
← anteriorpágina 226 / 869siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.