Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.388exploits catalogados

40.212CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 9990Nuclei 4547Metasploit 3531✓ solo verificadosrecientes populares riesgo

26.070 exploits

Referência

CVE-2026-9608

CVE-2026-9608MEDIUM

QianFox FoxCMS Administrator Backend edit cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2015-1423

CVE-2015-1423—

Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL com

23RIESGO

abrir ↗

Referência

CVE-2017-0146

CVE-2017-0146HIGHbajo ataqueransomware

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

abrir ↗

Referência

CVE-2017-15959

CVE-2017-15959—

Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-200

23RIESGO

abrir ↗

Referência✓ VexDay Proof

ArcadeBuilder Game Portal Manager 1.7 - SQL Injection

CVE-2007-3521—webappsphp

SQL injection vulnerability in ArcadeBuilder Game Portal Manager 1.7 allows remote attackers to execute arbitrary SQL co

23RIESGO

abrir ↗

Referência

CVE-2026-78837

CVE-2026-78837HIGH

A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitiv

41RIESGO

abrir ↗

Referência

CVE-2025-55241

CVE-2025-55241CRITICAL

Azure Entra ID Elevation of Privilege Vulnerability

48RIESGO

abrir ↗

Referência

CVE-2017-15974

CVE-2017-15974—

tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.

23RIESGO

abrir ↗

Referência

CVE-2018-25368

CVE-2018-25368HIGH

Nord VPN 6.14.31 Denial of Service via Password Field

41RIESGO

abrir ↗

Referência

CVE-2021-4464

CVE-2021-4464CRITICAL

FIberHome AN5506-04-FA / HG6245D Routers Remote Stack Overflow

48RIESGO

abrir ↗

Referência

CVE-2021-4464

CVE-2021-4464CRITICAL

FIberHome AN5506-04-FA / HG6245D Routers Remote Stack Overflow

48RIESGO

abrir ↗

Referência✓ VexDay Proof

E-Store Kit-1 < 2 PayPal Edition - 'pid' SQL Injection

CVE-2008-3594—webappsphp

SQL injection vulnerability in viewdetails.php in MagicScripts E-Store Kit-1, E-Store Kit-2, E-Store Kit-1 Pro PayPal Ed

23RIESGO

abrir ↗

Referência

CVE-2008-4751

CVE-2008-4751—

Cross-site scripting (XSS) vulnerability in index.php in iPei Guestbook 2.0 allows remote attackers to inject arbitrary

23RIESGO

abrir ↗

Referência✓ VexDay Proof

GPS CMS 1.2 - 'print.asp' SQL Injection

CVE-2007-0554—webappsasp

SQL injection vulnerability in print.asp in Guo Xu Guos Posting System (GPS) 1.2 allows remote attackers to execute arbi

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Constructr CMS 3.02.5 stable - Multiple Vulnerabilities

CVE-2008-5847—webappsphp

Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent atta

23RIESGO

abrir ↗

Referência

CVE-2010-2016

CVE-2010-2016—

SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via

23RIESGO

abrir ↗

Referência✓ VexDay Proof

yogurt 0.3 - Cross-Site Scripting / SQL Injection

CVE-2009-2034—webappsphp

SQL injection vulnerability in writemessage.php in Yogurt 0.3, when register_globals is enabled, allows remote authentic

23RIESGO

abrir ↗

Referência

CVE-2026-9440

CVE-2026-9440MEDIUM

Edimax BR-6478AC POST Request formAccept command injection

38RIESGO

abrir ↗

Referência

CVE-2010-0703

CVE-2010-0703—

Cross-site scripting (XSS) vulnerability in wa/auth in PortWise SSL VPN 4.6 allows remote attackers to inject arbitrary

23RIESGO

abrir ↗

Referência

CVE-2015-7247

CVE-2015-7247—

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and

28RIESGO

abrir ↗

Referência

CVE-2017-15975

CVE-2017-15975—

Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Buddy Zone 1.5 - 'view_sub_cat.php?cat_id' SQL Injection

CVE-2007-3549—webappsphp

SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL comma

23RIESGO

abrir ↗

Referência

CVE-2026-9295

CVE-2026-9295HIGH

Edimax BR-6428NS POST Request formWirelessTbl buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2015-7358

CVE-2015-7358—

The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when run

23RIESGO

abrir ↗

Referência

CVE-2019-9701

CVE-2019-9701—

DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue th

23RIESGO

abrir ↗

Referência

CVE-2020-13927

CVE-2020-13927CRITICALbajo ataque

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th

100RIESGO

abrir ↗

Referência

CVE-2024-53586

CVE-2024-53586MEDIUM

An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a cra

33RIESGO

abrir ↗

Referência

CVE-2025-34042

CVE-2025-34042CRITICAL

Beward N100 IP Camera Remote Command Execution

48RIESGO

abrir ↗

Referência

CVE-2025-34042

CVE-2025-34042CRITICAL

Beward N100 IP Camera Remote Command Execution

48RIESGO

abrir ↗

Referência

CVE-2025-34042

CVE-2025-34042CRITICAL

Beward N100 IP Camera Remote Command Execution

48RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.