Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.388exploits catalogados
40.212CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 9990Nuclei 4547Metasploit 3531✓ solo verificadosrecientespopularesriesgo
26.070 exploits
Referência
CVE-2025-34043
CVE-2025-34043CRITICAL
Vacron NVR Remote Command Execution
48RIESGO
abrir ↗
Referência
CVE-2017-17591
CVE-2017-17591—
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
23RIESGO
abrir ↗
Referência
CVE-2020-15930
CVE-2020-15930—
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
23RIESGO
abrir ↗
Referência
CVE-2018-6024
CVE-2018-6024—
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
23RIESGO
abrir ↗
Referência
CVE-2010-1708
CVE-2010-1708—
Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2013-1412
CVE-2013-1412—
DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/pr
50RIESGO
abrir ↗
Referência
CVE-2010-5016
CVE-2010-5016—
SQL injection vulnerability in matchdb.php in Elite Gaming Ladders 3.5 and earlier allows remote attackers to execute ar
23RIESGO
abrir ↗
Referência
CVE-2024-53584
CVE-2024-53584CRITICAL
OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.
48RIESGO
abrir ↗
Referência
CVE-2013-1464
CVE-2013-1464—
Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress al
23RIESGO
abrir ↗
Referência
CVE-2013-1468
CVE-2013-1468—
Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote att
23RIESGO
abrir ↗
Referência
CVE-2010-5017
CVE-2010-5017—
SQL injection vulnerability in stats.php in Elite Gaming Ladders 3.0 allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗
Referência
CVE-2017-11662
CVE-2017-11662—
The _WM_ParseNewMidi function in f_midi.c in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and appli
23RIESGO
abrir ↗
Referência
Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI
CVE-2025-49619HIGHwebappsmultiple
Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks suc
61RIESGO
abrir ↗
Referência
CVE-2013-1596
CVE-2013-1596—
An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP pac
28RIESGO
abrir ↗
Referência✓ VexDay Proof
ScriptMagix Photo Rating 2.0 - SQL Injection
CVE-2007-1619—webappsphp
SQL injection vulnerability in viewcomments.php in ScriptMagix Photo Rating 2.0 and earlier allows remote attackers to e
23RIESGO
abrir ↗
Referência
CVE-2014-3415
CVE-2014-3415—
SQL injection vulnerability in Sharetronix before 3.4 allows remote authenticated users to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2014-5380
CVE-2014-5380—
Grand MA 300 allows retrieval of the access PIN from sniffed data.
23RIESGO
abrir ↗
Referência
CVE-2026-13159
CVE-2026-13159MEDIUM
Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation
33RIESGO
abrir ↗
Referência
CVE-2017-6803
CVE-2017-6803—
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly
23RIESGO
abrir ↗
Referência
CVE-2026-13157
CVE-2026-13157HIGH
Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload
41RIESGO
abrir ↗
Referência
CVE-2019-0730
CVE-2019-0730—
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), ak
23RIESGO
abrir ↗
Referência
CVE-2011-4899
CVE-2011-4899—
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifie
23RIESGO
abrir ↗
Referência
CVE-2019-14749
CVE-2019-14749—
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the ex
23RIESGO
abrir ↗
Referência
CVE-2024-25736
CVE-2024-25736HIGH
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /d
41RIESGO
abrir ↗
Referência
CVE-2026-15236
CVE-2026-15236HIGH
Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure
41RIESGO
abrir ↗
Referência
CVE-2026-12697
CVE-2026-12697MEDIUM
wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
33RIESGO
abrir ↗
Referência✓ VexDay Proof
NEPT Image Uploader 1.0 - Arbitrary File Upload
CVE-2008-6822—webappsphp
Unrestricted file upload vulnerability in uploadp.php in New Earth Programming Team (NEPT) imgupload (aka Image Uploader
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
CVE-2009-1781—webappsphp
Static code injection vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to inj
23RIESGO
abrir ↗
Referência
CVE-2017-6803
CVE-2017-6803—
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly
23RIESGO
abrir ↗
Referência
CVE-2019-0730
CVE-2019-0730—
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), ak
23RIESGO
abrir ↗
← anteriorpágina 235 / 869siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.