Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
25.557 exploits
Referência
CVE-2026-7303
CVE-2026-7303MEDIUM
Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection
33RIESGO
abrir ↗
Referência
CVE-2026-7297
CVE-2026-7297MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php save_user cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-7296
CVE-2026-7296MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-7295
CVE-2026-7295MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php save_menu cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-7294
CVE-2026-7294MEDIUM
SourceCodester Pizzafy Ecommerce System index.php save_settings cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Active Web Mail 4 - Blind SQL Injection
CVE-2008-6873—webappsasp
SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the Tab
23RIESGO
abrir ↗
Referência✓ VexDay Proof
my-colex 1.4.2 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2009-1825—webappsphp
modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated u
23RIESGO
abrir ↗
Referência
CVE-2013-3660
CVE-2013-3660HIGHbajo ataque
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windo
98RIESGO
abrir ↗
Referência✓ VexDay Proof
my-gesuad 0.9.14 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2009-1826—webappsphp
modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote aut
23RIESGO
abrir ↗
Referência✓ VexDay Proof
virtue news - SQL Injection / Cross-Site Scripting
CVE-2009-2019—webappsphp
SQL injection vulnerability in news_detail.php in Virtue News Manager allows remote attackers to execute arbitrary SQL c
23RIESGO
abrir ↗
Referência✓ VexDay Proof
EsFaq 2.0 - 'idcat' SQL Injection
CVE-2008-3952—webappsphp
SQL injection vulnerability in questions.php in EsFaq 2.0 allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TorrentVolve 1.4 - 'deleteTorrent' Delete Arbitrary File
CVE-2009-2101—webappsphp
Directory traversal vulnerability in archive.php in TorrentVolve 1.4, when register_globals is enabled, allows remote at
23RIESGO
abrir ↗
Referência✓ VexDay Proof
DB Top Sites 1.0 - Remote Command Execution
CVE-2009-2111—webappsphp
Static code injection vulnerability in add_reg.php in DB Top Sites 1.0 allows remote attackers to inject arbitrary PHP c
23RIESGO
abrir ↗
Referência
CVE-2021-43798
CVE-2021-43798HIGHbajo ataque
Grafana path traversal
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component mosDirectory 2.3.2 - Remote File Inclusion
CVE-2007-6555—webappsphp
PHP remote file inclusion vulnerability in modules/mod_pxt_latest.php in the mosDirectory (com_directory) 2.3.2 componen
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TekBase All-in-One 3.1 - Multiple SQL Injections
CVE-2009-2120—webappsphp
Multiple SQL injection vulnerabilities in TekBase All-in-One 3.1 allow remote authenticated users to execute arbitrary S
23RIESGO
abrir ↗
Referência✓ VexDay Proof
OCS Inventory NG 1.02 - Remote File Disclosure
CVE-2009-2166—webappsphp
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to re
23RIESGO
abrir ↗
Referência✓ VexDay Proof
EgyPlus 7ml 1.0.1 - Authentication Bypass
CVE-2009-2167—webappsphp
Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quo
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Easy Px 41 CMS 09.00.00B1 - 'fiche' Local File Inclusion
CVE-2009-1847—webappsphp
Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
vBulletin Radio and TV Player AddOn - HTML Injection
CVE-2009-2172—webappsphp
Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows r
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WonderEdit Pro CMS (template_path) - Remote File Inclusion
CVE-2006-3422—webappsphp
PHP remote file inclusion vulnerability in WonderEdit Pro CMS allows remote attackers to execute arbitrary PHP code via
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component EZ Store Remote - Blind SQL Injection
CVE-2008-3586—webappsphp
SQL injection vulnerability in the EZ Store (com_ezstore) component for Joomla! allows remote attackers to execute arbit
23RIESGO
abrir ↗
Referência
CVE-2013-3961
CVE-2013-3961—
SQL injection vulnerability in edit_event.php in Simple PHP Agenda before 2.2.9 allows remote authenticated users to exe
23RIESGO
abrir ↗
Referência✓ VexDay Proof
NmnNewsletter 1.0.7 - 'output' Remote File Inclusion
CVE-2007-6585—webappsphp
PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to e
23RIESGO
abrir ↗
Referência✓ VexDay Proof
OpenImpro 1.1 - 'image.php' SQL Injection
CVE-2008-3599—webappsphp
SQL injection vulnerability in image.php in OpenImpro 1.1 allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PozScripts Classified Ads Script - 'cid' SQL Injection
CVE-2008-3673—webappsphp
SQL injection vulnerability in browsecats.php in PozScripts Classified Ads allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TubeGuru Video Sharing Script - 'UID' SQL Injection
CVE-2008-3674—webappsphp
SQL injection vulnerability in ugroups.php in PozScripts TubeGuru Video Sharing Script allows remote attackers to execut
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CFAGCMS 1 - SQL Injection
CVE-2008-5781—webappsphp
SQL injection vulnerability in right.php in Cant Find A Gaming CMS (CFAGCMS) 1.0 Beta 1 allows remote attackers to execu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
V3 Chat Live Support 3.0.4 - Insecure Cookie Handling
CVE-2008-5783—webappsphp
admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative a
23RIESGO
abrir ↗
Referência
CVE-2012-2109
CVE-2012-2109—
SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attack
23RIESGO
abrir ↗
← anteriorpágina 25 / 852siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.