Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.390exploits catalogados
40.212CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 9992Nuclei 4547Metasploit 3531✓ solo verificadosrecientespopularesriesgo
26.070 exploits
Referência✓ VexDay Proof
PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass
CVE-2008-4614—webappsasp
PortalApp 4.0 does not require authentication for (1) forums.asp and (2) content.asp, which allows remote attackers to c
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PowerTCP FTP Module - Multiple Techniques (SEH HeapSpray)
CVE-2008-4652—remotewindows
Buffer overflow in the ActiveX control (DartFtp.dll) in Dart Communications PowerTCP FTP for ActiveX 2.0.2 0 allows remo
28RIESGO
abrir ↗
Referência✓ VexDay Proof
XOOPS Module makale 0.26 - SQL Injection
CVE-2008-4653—webappsphp
SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote
23RIESGO
abrir ↗
Referência
CVE-2009-3528
CVE-2009-3528—
SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows remote authenticated users to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência
CVE-2014-7280
CVE-2014-7280—
Cross-site scripting (XSS) vulnerability in the Web UI before 2.3.4 Build #85 for Tenable Nessus 5.x allows remote web s
23RIESGO
abrir ↗
Referência
CVE-2015-4630
CVE-2015-4630—
Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x
23RIESGO
abrir ↗
Referência
CVE-2015-4664
CVE-2015-4664—
An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers t
28RIESGO
abrir ↗
Referência
CVE-2015-4683
CVE-2015-4683—
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potenti
23RIESGO
abrir ↗
Referência
CVE-2022-47966
CVE-2022-47966CRITICALbajo ataqueransomware
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due
100RIESGO
abrir ↗
Referência
CVE-2022-47966
CVE-2022-47966CRITICALbajo ataqueransomware
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due
100RIESGO
abrir ↗
Referência
CVE-2022-47966
CVE-2022-47966CRITICALbajo ataqueransomware
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due
100RIESGO
abrir ↗
Referência
CVE-2015-4038
CVE-2015-4038—
The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an i
23RIESGO
abrir ↗
Referência
CVE-2026-8759
CVE-2026-8759MEDIUM
xiandafu beetl SpELFunction SpELFunction.java expression language injection
33RIESGO
abrir ↗
Referência
CVE-2026-8758
CVE-2026-8758MEDIUM
Metasoft 美特软件 MetaCRM upload3.jsp unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-84937
CVE-2026-84937MEDIUM
YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax
33RIESGO
abrir ↗
Referência
CVE-2015-3036
CVE-2015-3036—
Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in c
28RIESGO
abrir ↗
Referência
CVE-2021-38647
CVE-2021-38647CRITICALbajo ataqueransomware
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
100RIESGO
abrir ↗
Referência
CVE-2026-84936
CVE-2026-84936MEDIUM
EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Mihalism Multi Host Download - 'Username' Blind SQL Injection
CVE-2008-0714—webappsphp
SQL injection vulnerability in users.php in Mihalism Multi Host allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Dream4 Koobi CMS 4.3.0 < 4.2.3 - 'categ' SQL Injection
CVE-2008-1336—webappsphp
SQL injection vulnerability in Koobi CMS 4.2.3 through 4.3.0 allows remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Dream4 Koobi Pro 6.25 Showimages - 'galid' SQL Injection
CVE-2008-4778—webappsphp
SQL injection vulnerability in the gallery module in Koobi CMS 4.3.0 allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗
Referência
CVE-2014-3544
CVE-2014-3544—
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before
23RIESGO
abrir ↗
Referência
CVE-2015-6811
CVE-2015-6811—
SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlie
23RIESGO
abrir ↗
Referência
CVE-2022-0543
CVE-2022-0543CRITICALbajo ataque
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
100RIESGO
abrir ↗
Referência
CVE-2016-0891
CVE-2016-0891—
Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remo
23RIESGO
abrir ↗
Referência
CVE-2026-71626
CVE-2026-71626HIGH
An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.
41RIESGO
abrir ↗
Referência
CVE-2014-3704
CVE-2014-3704—
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗
Referência
CVE-2014-8739
CVE-2014-8739—
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery
60RIESGO
abrir ↗
Referência
CVE-2021-31166
CVE-2021-31166CRITICALbajo ataque
HTTP Protocol Stack Remote Code Execution Vulnerability
100RIESGO
abrir ↗
Referência
CVE-2023-46604
CVE-2023-46604CRITICALbajo ataqueransomware
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RIESGO
abrir ↗
← anteriorpágina 236 / 869siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.