Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.390exploits catalogados
40.212CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 9992Nuclei 4547Metasploit 3531✓ solo verificadosrecientespopularesriesgo
26.070 exploits
Referência
CVE-2016-5740
CVE-2016-5740—
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical atta
23RIESGO
abrir ↗
Referência
CVE-2017-9101
CVE-2017-9101—
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User
60RIESGO
abrir ↗
Referência✓ VexDay Proof
F-Prot AntiVirus 4.6.6 - 'ACE' Denial of Service
CVE-2006-6352—doslinux
FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to cause a denial of service (infinit
23RIESGO
abrir ↗
Referência
CVE-2015-2208
CVE-2015-2208—
The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via she
50RIESGO
abrir ↗
Referência
CVE-2026-87762
CVE-2026-87762HIGH
Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling
41RIESGO
abrir ↗
Referência
CVE-2026-34097
CVE-2026-34097MEDIUM
Guardian Language-System XSS via id Parameter in text_file.php
33RIESGO
abrir ↗
Referência
CVE-2026-34096
CVE-2026-34096MEDIUM
Guardian Language-System XSS via name Parameter in designer.php
33RIESGO
abrir ↗
Referência
CVE-2026-59097
CVE-2026-59097MEDIUM
Taiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets
33RIESGO
abrir ↗
Referência
CVE-2026-9576
CVE-2026-9576MEDIUM
Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export
33RIESGO
abrir ↗
Referência
CVE-2026-59095
CVE-2026-59095HIGH
LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl
41RIESGO
abrir ↗
Referência
CVE-2026-59094
CVE-2026-59094HIGH
Pathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document Store
41RIESGO
abrir ↗
Referência
CVE-2026-58127
CVE-2026-58127CRITICAL
PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
48RIESGO
abrir ↗
Referência
CVE-2026-87933
CVE-2026-87933MEDIUM
DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
33RIESGO
abrir ↗
Referência
CVE-2026-87925
CVE-2026-87925MEDIUM
Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-87761
CVE-2026-87761HIGH
Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings
41RIESGO
abrir ↗
Referência
CVE-2026-84734
CVE-2026-84734CRITICAL
Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter
48RIESGO
abrir ↗
Referência
CVE-2026-11562
CVE-2026-11562MEDIUM
WS Form LITE < 1.11.8 - Subscriber+ Arbitrary Settings Update
33RIESGO
abrir ↗
Referência
CVE-2026-13565
CVE-2026-13565MEDIUM
SourceCodester Class and Exam Timetabling System edit_class1.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-13563
CVE-2026-13563HIGH
Edimax EW-7478APC POST Request formL2TPSetup stack-based overflow
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Million Pixels 3 - 'id_cat' SQL Injection
CVE-2008-3204—webappsphp
SQL injection vulnerability in tops_top.php in E-topbiz Million Pixels 3 allows remote attackers to execute arbitrary SQ
23RIESGO
abrir ↗
Referência✓ VexDay Proof
preCMS 1 - 'index.php' SQL Injection
CVE-2008-3254—webappsphp
SQL injection vulnerability in index.php in preCMS 1 allows remote attackers to execute arbitrary SQL commands via the i
23RIESGO
abrir ↗
Referência
CVE-2009-4755
CVE-2009-4755—
Multiple stack-based buffer overflows in Mercury Audio Player 1.21 allow remote attackers to execute arbitrary code via
23RIESGO
abrir ↗
Referência
CVE-2012-4060
CVE-2012-4060—
Multiple SQL injection vulnerabilities in ASP-DEv XM Forums RC3 allow remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2015-2216
CVE-2015-2216—
SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to exec
23RIESGO
abrir ↗
Referência
CVE-2015-2275
CVE-2015-2275—
Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to i
23RIESGO
abrir ↗
Referência✓ VexDay Proof
mxBB Module Profile CP 0.91c - Remote File Inclusion
CVE-2006-6566—webappsphp
PHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module
23RIESGO
abrir ↗
Referência
CVE-2015-2275
CVE-2015-2275—
Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to i
23RIESGO
abrir ↗
Referência✓ VexDay Proof
mxBB Module kb_mods 2.0.2 - Remote File Inclusion
CVE-2006-6568—webappsphp
Directory traversal vulnerability in includes/kb_constants.php in the Knowledge Base (mx_kb) 2.0.2 module for mxBB allow
23RIESGO
abrir ↗
Referência✓ VexDay Proof
AR Memberscript - 'usercp_menu.php' Remote File Inclusion
CVE-2006-6590—webappsphp
PHP remote file inclusion vulnerability in usercp_menu.php in AR Memberscript allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2026-12809
CVE-2026-12809MEDIUM
Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection
33RIESGO
abrir ↗
← anteriorpágina 238 / 869siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.