Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.634exploits catalogados
40.286CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.110Exploit-DB 24.488GitHub PoC 17.941VulnCheck XDB 10.016Nuclei 4547Metasploit 3532✓ solo verificadosrecientespopularesriesgo
26.110 exploits
Referência✓ VexDay Proof
LinPHA 1.3.3 Plugin Maps - Remote Command Execution
plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication for a settings action that modif
23RIESGO
abrir ↗Referência
CVE-2009-3366
Directory traversal vulnerability in navigation.php in An image gallery 1.0 allows remote attackers to list arbitrary di
23RIESGO
abrir ↗Referência
CVE-2011-2944
SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitra
23RIESGO
abrir ↗Referência✓ VexDay Proof
Pet Grooming Management System 2.0 - Arbitrary Add Admin
Pet Grooming Management System 2.0 allows remote attackers to gain privileges via a direct request to useradded.php with
23RIESGO
abrir ↗Referência✓ VexDay Proof
Pooya Site Builder (PSB) 6.0 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Pooya Site Builder (PSB) 6.0 allow remote attackers to execute arbitrary SQL c
23RIESGO
abrir ↗Referência✓ VexDay Proof
LokiCMS 0.3.3 - Arbitrary File Delete
Directory traversal vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to delete arbitrary
23RIESGO
abrir ↗Referência
CVE-2008-5180
Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of ser
45RIESGO
abrir ↗Referência
CVE-2009-4807
Multiple SQL injection vulnerabilities in Graugon PHP Article Publisher 1.0 allow remote attackers to execute arbitrary
23RIESGO
abrir ↗Referência
CVE-2009-4834
lib.php in Zeroboard 4.1 pl7 allows remote attackers to execute arbitrary PHP code via a crafted parameter name, possibl
23RIESGO
abrir ↗Referência
CVE-2009-4836
Eval injection vulnerability in system/services/init.php in Movie PHP Script 2.0 allows remote attackers to execute arbi
23RIESGO
abrir ↗Referência
CVE-2026-19348
Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection
48RIESGO
abrir ↗Referência
CVE-2026-90814
cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery
33RIESGO
abrir ↗Referência
CVE-2024-23897
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RIESGO
abrir ↗Referência
CVE-2026-90813
cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize
33RIESGO
abrir ↗Referência
CVE-2026-19347
itsourcecode Hospital Management System viewdoctor.php sql injection
33RIESGO
abrir ↗Referência✓ VexDay Proof
ScriptMagix Recipes 2.0 - 'index.php?catid' SQL Injection
SQL injection vulnerability in index.php in ScriptMagix Recipes 2.0 and earlier allows remote attackers to execute arbit
23RIESGO
abrir ↗Referência✓ VexDay Proof
Active PHP Bookmark Notes 0.2.5 - Remote File Inclusion
PHP remote file inclusion vulnerability in templates/head.php in Active PHP Bookmark Notes (APB) 0.2.5 and earlier allow
23RIESGO
abrir ↗Referência✓ VexDay Proof
Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion
Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and ex
23RIESGO
abrir ↗Referência✓ VexDay Proof
falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting
Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbi
23RIESGO
abrir ↗Referência
CVE-2015-2843
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute
50RIESGO
abrir ↗Referência
CVE-2015-5531
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
60RIESGO
abrir ↗Referência✓ VexDay Proof
Basic-CMS - SQL Injection
SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands vi
43RIESGO
abrir ↗Referência✓ VexDay Proof
Comparison Engine Power 1.0 - Blind SQL Injection
SQL injection vulnerability in product.detail.php in Kalptaru Infotech Comparison Engine Power Script 1.0 allows remote
23RIESGO
abrir ↗Referência✓ VexDay Proof
X7 Chat 2.0.1A1 - 'mini.php' Local File Inclusion
Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an
23RIESGO
abrir ↗Referência✓ VexDay Proof
Apple iTunes 8.1.1 - 'ITMS' Multiple Protocol Handler Buffer Overflow (Metasploit)
Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a deni
43RIESGO
abrir ↗Referência
CVE-2012-6493
Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers
23RIESGO
abrir ↗Referência
CVE-2024-38887
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows
48RIESGO
abrir ↗Referência
CVE-2013-7349
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.