Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.634exploits catalogados
40.286CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.110Exploit-DB 24.488GitHub PoC 17.941VulnCheck XDB 10.016Nuclei 4547Metasploit 3532✓ solo verificadosrecientespopularesriesgo
26.110 exploits
Referência✓ VexDay Proof
Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to inject arbitrary
23RIESGO
abrir ↗Referência
CVE-2018-18435
KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any
23RIESGO
abrir ↗Referência
CVE-2015-5996
Cross-site request forgery (CSRF) vulnerability on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 allo
23RIESGO
abrir ↗Referência
CVE-2018-18435
KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any
23RIESGO
abrir ↗Referência
CVE-2014-0981
VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x bef
23RIESGO
abrir ↗Referência✓ VexDay Proof
Links Management Application 1.0 - 'lcnt' SQL Injection
SQL injection vulnerability in index.php in Links Management Application 1.0 allows remote attackers to execute arbitrar
23RIESGO
abrir ↗Referência
CVE-2022-48079
Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execu
48RIESGO
abrir ↗Referência
Seowon SLR-120 Router - Remote Code Execution (Unauthenticated)
SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi pa
60RIESGO
abrir ↗Referência
CVE-2010-2505
Soft SaschArt SasCAM Webcam Server 2.6.5, 2.7, and earlier allows remote attackers to cause a denial of service (crash)
23RIESGO
abrir ↗Referência
CVE-2012-3872
Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrar
23RIESGO
abrir ↗Referência
CVE-2021-31650
A SQL injection vulnerability in Sourcecodester Online Grading System 1.0 allows remote attackers to execute arbitrary S
48RIESGO
abrir ↗Referência
CVE-2017-17737
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diag
23RIESGO
abrir ↗Referência
CVE-2012-6585
Cross-site scripting (XSS) vulnerability in search.php in MYRE Realty Manager allows remote attackers to inject arbitrar
23RIESGO
abrir ↗Referência
CVE-2009-3805
gpg2.exe in Gpg4win 2.0.1, as used in KDE Kleopatra 2.0.11, allows remote attackers to cause a denial of service (applic
23RIESGO
abrir ↗Referência
CVE-2010-2313
Directory traversal vulnerability in index.php in Anodyne Productions SIMM Management System (SMS) 2.6.10, when magic_qu
23RIESGO
abrir ↗Referência
CVE-2010-2342
SQL injection vulnerability in onlinenotebookmanager.asp in DMXReady Online Notebook Manager 1.0 allows remote attackers
23RIESGO
abrir ↗Referência
CVE-2018-13441
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows atta
23RIESGO
abrir ↗Referência
CVE-2026-110010
MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter
33RIESGO
abrir ↗Referência
CVE-2026-70615
boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation
41RIESGO
abrir ↗Referência✓ VexDay Proof
PHPNS 1.1 - 'shownews.php?id' SQL Injection
SQL injection vulnerability in shownews.php in phpns 1.1 allows remote attackers to execute arbitrary SQL commands via t
23RIESGO
abrir ↗Referência✓ VexDay Proof
Acoustica Mixcraft 4.2 Build 98 - 'mx4' Local Buffer Overflow
Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execut
23RIESGO
abrir ↗Referência
CVE-2016-3653
Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager
23RIESGO
abrir ↗Referência✓ VexDay Proof
webEdition 6.0.0.4 - 'WE_LANGUAGE' Local File Inclusion
Directory traversal vulnerability in index.php in webEdition 6.0.0.4 and earlier, when register_globals is enabled and m
23RIESGO
abrir ↗Referência
CVE-2011-4806
Multiple cross-site scripting (XSS) vulnerabilities in main.php in phpAlbum 0.4.1.16 and earlier allow remote attackers
23RIESGO
abrir ↗Referência
CVE-2012-2573
Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrar
23RIESGO
abrir ↗Referência
CVE-2010-2038
Cross-site scripting (XSS) vulnerability in include/tool/editing_files.php in gpEasy CMS 1.6.2 allows remote authenticat
23RIESGO
abrir ↗Referência✓ VexDay Proof
Pc4Uploader 9.0 - Blind SQL Injection
code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks vi
23RIESGO
abrir ↗Referência
CVE-2026-108652
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar
33RIESGO
abrir ↗Referência
CVE-2010-3484
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.