Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.496exploits catalogados
40.252CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.094Exploit-DB 24.488GitHub PoC 17.821VulnCheck XDB 10.014Nuclei 4547Metasploit 3532✓ solo verificadosrecientespopularesriesgo
26.094 exploits
Referência
CVE-2018-6226
Reflected cross-site scripting (XSS) vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration files
23RIESGO
abrir ↗Referência
CVE-2024-25004
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insuf
41RIESGO
abrir ↗Referência✓ VexDay Proof
Talkback 2.3.6 - Multiple Local File Inclusion / PHPInfo Disclosure Vulnerabilities
TalkBack 2.3.6 allows remote attackers to obtain configuration information via a direct request to install/info.php, whi
23RIESGO
abrir ↗Referência
CVE-2009-3802
Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain sensitive information via an invalid loginname ("%%%") t
23RIESGO
abrir ↗Referência
CVE-2012-6568
Buffer overflow in the back-end component in Huawei UTPS 1.0 allows local users to gain privileges via a long IDS_PLUGIN
23RIESGO
abrir ↗Referência
CVE-2009-4585
UranyumSoft Listing Service stores sensitive information under the web root with insufficient access control, which allo
23RIESGO
abrir ↗Referência
CVE-2009-4585
UranyumSoft Listing Service stores sensitive information under the web root with insufficient access control, which allo
23RIESGO
abrir ↗Referência
CVE-2009-4760
Winn ASP Guestbook 1.01 Beta stores sensitive information under the web root with insufficient access control, which all
23RIESGO
abrir ↗Referência✓ VexDay Proof
Joovili 3.1.4 - Insecure Cookie Handling
Joovili 3.1.4 allows remote attackers to bypass authentication and gain privileges as other users, including the adminis
23RIESGO
abrir ↗Referência
ManageEngine Application Manager 14.2 - Privilege Escalation / Remote Command Execution (Metasploit)
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in
23RIESGO
abrir ↗Referência✓ VexDay Proof
Free PHP VX Guestbook 1.06 - Insecure Cookie Handling
Free PHP VX Guestbook 1.06 allows remote attackers to bypass authentication and gain administrative access by setting th
23RIESGO
abrir ↗Referência
CVE-2009-3544
Xerver HTTP Server 4.32 allows remote attackers to obtain the source code for a web page via an HTTP request with the ad
23RIESGO
abrir ↗Referência✓ VexDay Proof
Corel WordPerfect X3 13.0.0.565 - '.prs' Local Buffer Overflow
Stack-based buffer overflow in Corel WordPerfect Office X3 (13.0.0.565) allows user-assisted remote attackers to execute
23RIESGO
abrir ↗Referência
CVE-2012-6584
Multiple SQL injection vulnerabilities in MYRE Realty Manager allow remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗Referência✓ VexDay Proof
Crux Gallery 1.32 - Insecure Cookie Handling
main.php in Crux Gallery 1.32 and earlier allows remote attackers to gain administrative access by setting the name para
23RIESGO
abrir ↗Referência
CVE-2012-5224
PHP remote file inclusion vulnerability in vb/includes/vba_cmps_include_bottom.php in vBadvanced CMPS 3.2.2 and earlier
23RIESGO
abrir ↗Referência
CVE-2014-10029
SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to exe
23RIESGO
abrir ↗Referência
CVE-2015-3106
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
35RIESGO
abrir ↗Referência✓ VexDay Proof
postecards - SQL Injection / File Disclosure
PostEcards stores sensitive information under the web root with insufficient access control, which allows remote attacke
23RIESGO
abrir ↗Referência
CVE-2016-4226
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RIESGO
abrir ↗Referência✓ VexDay Proof
Enthusiast 3.1.4 - 'show_joined.php' Remote File Inclusion
PHP remote file inclusion vulnerability in show_joined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows
23RIESGO
abrir ↗Referência
CVE-2026-12183
Nefteprodukttekhnika BUK TS-G Gas Station Automation System Authentication Bypass via ajax-login.php Accepting Arbitrary Credentials
48RIESGO
abrir ↗Referência
CVE-2018-0982
An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows
23RIESGO
abrir ↗Referência
CVE-2009-2770
PowerUpload 2.4 allows remote attackers to bypass authentication and gain administrative access via a MIME encoded value
23RIESGO
abrir ↗Referência
CVE-2009-3422
login.php in Zenas PaoLiber 1.1, when register_globals is enabled, allows remote attackers to bypass authentication and
23RIESGO
abrir ↗Referência✓ VexDay Proof
IceBB 1.0-rc5 - Remote Code Execution
Unrestricted file upload vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to upload arbitra
23RIESGO
abrir ↗Referência✓ VexDay Proof
TurnkeyForms Local Classifieds - Authentication Bypass
TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a dir
23RIESGO
abrir ↗Referência✓ VexDay Proof
AJ Auction - Authentication Bypass
AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when
23RIESGO
abrir ↗Referência
CVE-2010-3023
Multiple cross-site scripting (XSS) vulnerabilities in DiamondList 0.1.6, and possibly earlier, allow remote attackers t
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.