Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.412exploits catalogados
40.212CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.070Exploit-DB 24.488GitHub PoC 17.762VulnCheck XDB 10.014Nuclei 4547Metasploit 3531✓ solo verificadosrecientespopularesriesgo
26.070 exploits
Referência
CVE-2017-17636
CVE-2017-17636—
MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-16992
CVE-2026-16992MEDIUM
Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
33RIESGO
abrir ↗
Referência
CVE-2026-108882
CVE-2026-108882MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser
33RIESGO
abrir ↗
Referência
CVE-2026-8275
CVE-2026-8275MEDIUM
bettercap zerogod IPP Service zerogod_ipp_primitives.go ippReadChunkedBody integer coercion
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component NeoRecruit 1.4 - 'id' SQL Injection
CVE-2007-4506—webappsphp
SQL injection vulnerability in index.php in the NeoRecruit component (com_neorecruit) 1.4 and earlier for Joomla! allows
23RIESGO
abrir ↗
Referência
CVE-2008-3774
CVE-2008-3774—
SQL injection vulnerability in index.php in Simasy CMS allows remote attackers to execute arbitrary SQL commands via the
23RIESGO
abrir ↗
Referência
CVE-2023-51951
CVE-2023-51951CRITICAL
SQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the id
48RIESGO
abrir ↗
Referência
CVE-2021-33352
CVE-2021-33352CRITICAL
An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitra
48RIESGO
abrir ↗
Referência✓ VexDay Proof
Venalsur on-line Booking Centre - Cross-Site Scripting / SQL Injection
CVE-2008-6216—webappsphp
SQL injection vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows
23RIESGO
abrir ↗
Referência
CVE-2022-38573
CVE-2022-38573CRITICAL
10-Strike Network Inventory Explorer v9.3 was discovered to contain a buffer overflow via the Add Computers function.
48RIESGO
abrir ↗
Referência
CVE-2022-38573
CVE-2022-38573CRITICAL
10-Strike Network Inventory Explorer v9.3 was discovered to contain a buffer overflow via the Add Computers function.
48RIESGO
abrir ↗
Referência✓ VexDay Proof
Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) UDEV < 1.4.1 - Local Privilege Escalation (2)
CVE-2009-1185—locallinux
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to ga
60RIESGO
abrir ↗
Referência
CVE-2024-10758
CVE-2024-10758MEDIUM
code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2011-4830
CVE-2011-4830—
Multiple cross-site scripting (XSS) vulnerabilities in the com_listing component in Barter Sites component 1.3 for Jooml
23RIESGO
abrir ↗
Referência
CVE-2017-1000370
CVE-2017-1000370—
The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed wit
23RIESGO
abrir ↗
Referência
CVE-2011-1667
CVE-2011-1667—
SQL injection vulnerability in index.php in Anzeigenmarkt 2011 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2017-17738
CVE-2017-17738—
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools
23RIESGO
abrir ↗
Referência
CVE-2018-10507
CVE-2018-10507—
A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to take a series of steps to bypass or
23RIESGO
abrir ↗
Referência
RPi-Jukebox-RFID 2.8.0 - Remote Command Execution
CVE-2025-10327MEDIUMwebappsmultiple
MiczFlor RPi-Jukebox-RFID shuffle.php os command injection
38RIESGO
abrir ↗
Referência
CVE-2010-1496
CVE-2010-1496—
SQL injection vulnerability in the JoltCard (com_joltcard) component 1.2.1 for Joomla! allows remote attackers to execut
23RIESGO
abrir ↗
Referência
CVE-2010-1496
CVE-2010-1496—
SQL injection vulnerability in the JoltCard (com_joltcard) component 1.2.1 for Joomla! allows remote attackers to execut
23RIESGO
abrir ↗
Referência
CVE-2011-1667
CVE-2011-1667—
SQL injection vulnerability in index.php in Anzeigenmarkt 2011 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2026-8267
CVE-2026-8267MEDIUM
Open5GS SMF smf_nsmf_handle_created_data_in_vsmf denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-108870
CVE-2026-108870MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion
CVE-2007-4640—webappsphp
Unrestricted file upload vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to upload an
23RIESGO
abrir ↗
Referência
CVE-2026-18720
CVE-2026-18720MEDIUM
kalcaddle kodbox msgWarning Plugin action improper authorization
33RIESGO
abrir ↗
Referência
CVE-2012-2571
CVE-2012-2571—
Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbitr
23RIESGO
abrir ↗
Referência
CVE-2026-103234
CVE-2026-103234MEDIUM
WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email
33RIESGO
abrir ↗
Referência
CVE-2012-5367
CVE-2012-5367—
Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbi
23RIESGO
abrir ↗
Referência
CVE-2011-5160
CVE-2011-5160—
Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web scrip
23RIESGO
abrir ↗
← anteriorpágina 243 / 869siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.