Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.412exploits catalogados
40.212CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 10.014Nuclei 4547Metasploit 3531✓ solo verificadosrecientespopularesriesgo
26.070 exploits
Referência
CVE-2026-9434
CVE-2026-9434CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection
48RIESGO
abrir ↗
Referência
CVE-2022-41040
CVE-2022-41040HIGHbajo ataqueransomware
Microsoft Exchange Server Elevation of Privilege Vulnerability
100RIESGO
abrir ↗
Referência
CVE-2026-9431
CVE-2026-9431HIGH
Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2013-6987
CVE-2013-6987—
Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before
28RIESGO
abrir ↗
Referência
CVE-2013-7186
CVE-2013-7186—
Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long
28RIESGO
abrir ↗
Referência
CVE-2013-7186
CVE-2013-7186—
Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long
28RIESGO
abrir ↗
Referência
CVE-2013-7186
CVE-2013-7186—
Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long
28RIESGO
abrir ↗
Referência
CVE-2014-9418
CVE-2014-9418—
The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in Huawei eSpace Desktop before V200R001C03 allows local users
23RIESGO
abrir ↗
Referência
CVE-2014-9611
CVE-2014-9611—
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via
28RIESGO
abrir ↗
Referência
CVE-2014-9612
CVE-2014-9612—
SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1
23RIESGO
abrir ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHbajo ataque
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Xerox Phaser 8400 - Remote Reboot (Denial of Service)
CVE-2008-3571—doshardware
The Xerox Phaser 8400 allows remote attackers to cause a denial of service (reboot) via an empty UDP packet to port 1900
35RIESGO
abrir ↗
Referência
CVE-2014-9641
CVE-2014-9641—
The tmeext.sys driver before 2.0.0.1015 in Trend Micro Antivirus Plus, Internet Security, and Maximum Security allows lo
23RIESGO
abrir ↗
Referência
CVE-2020-10189
CVE-2020-10189CRITICALbajo ataque
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted d
100RIESGO
abrir ↗
Referência
CVE-2013-7409
CVE-2013-7409—
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possib
50RIESGO
abrir ↗
Referência
CVE-2021-3129
CVE-2021-3129CRITICALbajo ataqueransomware
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RIESGO
abrir ↗
Referência
CVE-2021-3129
CVE-2021-3129CRITICALbajo ataqueransomware
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RIESGO
abrir ↗
Referência
CVE-2026-86674
CVE-2026-86674MEDIUM
ningzichun Student Management System login.php session_start session fixiation
33RIESGO
abrir ↗
Referência
CVE-2026-41453
CVE-2026-41453HIGH
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
41RIESGO
abrir ↗
Referência
CVE-2011-4831
CVE-2011-4831—
Directory traversal vulnerability in webFileBrowser.php in Web File Browser 0.4b14 allows remote authenticated users to
23RIESGO
abrir ↗
Referência✓ VexDay Proof
SquirrelMail G/PGP Encryption Plugin 2.0 - Command Execution
CVE-2005-1924—webappsphp
The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands v
28RIESGO
abrir ↗
Referência
CVE-2014-9583
CVE-2014-9583—
common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC
60RIESGO
abrir ↗
Referência
CVE-2023-34362
CVE-2023-34362CRITICALbajo ataqueransomware
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
100RIESGO
abrir ↗
Referência
CVE-2023-34362
CVE-2023-34362CRITICALbajo ataqueransomware
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
100RIESGO
abrir ↗
Referência
CVE-2026-85379
CVE-2026-85379MEDIUM
light0011 cms Query Builder ChapterController.class.php searchChapter sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-65710
CVE-2026-65710HIGH
sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption
41RIESGO
abrir ↗
Referência
CVE-2009-3246
CVE-2009-3246—
SQL injection vulnerability in spnews.php in MyBuxScript PTC-BUX allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2009-4805
CVE-2009-4805—
Multiple SQL injection vulnerabilities in EZ-Blog Beta 1, when magic_quotes_gpc is disabled, allow remote attackers to e
23RIESGO
abrir ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6502—webappsasp
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1)
23RIESGO
abrir ↗
Referência✓ VexDay Proof
BlogPHP 2 - 'id' Cross-Site Scripting / SQL Injection
CVE-2008-0678—webappsphp
SQL injection vulnerability in index.php in BlogPHP 2.0 allows remote attackers to execute arbitrary SQL commands via th
23RIESGO
abrir ↗
← anteriorpágina 242 / 869siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.