Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.634exploits catalogados

40.286CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.110Exploit-DB 24.488GitHub PoC 17.941VulnCheck XDB 10.016Nuclei 4547Metasploit 3532✓ solo verificadosrecientes populares riesgo

26.110 exploits

Referência

CVE-2021-41556

CVE-2021-41556CRITICAL

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that ca

48RIESGO

abrir ↗

Referência✓ VexDay Proof

phpBB Ajax Shoutbox 0.0.5 - Remote File Inclusion

CVE-2006-5312—webappsphp

PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows r

23RIESGO

abrir ↗

Referência✓ VexDay Proof

MiniGal b13 - Remote Code Execution

CVE-2007-2145—webappsphp

The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a fil

23RIESGO

abrir ↗

Referência

CVE-2015-4118

CVE-2015-4118—

SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated user

23RIESGO

abrir ↗

Referência

CVE-2012-0899

CVE-2012-0899—

Cross-site scripting (XSS) vulnerability in referencement/sites_inscription.php in Annuaire PHP allows remote attackers

23RIESGO

abrir ↗

Referência

CVE-2009-4993

CVE-2009-4993—

PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbit

23RIESGO

abrir ↗

Referência✓ VexDay Proof

VWar 1.5.0 R15 - 'mvcw.php' Remote File Inclusion

CVE-2007-4605—webappsphp

PHP remote file inclusion vulnerability in convert/mvcw.php in Virtual War (VWar) 1.5.0 R15 and earlier allows remote at

23RIESGO

abrir ↗

Referência✓ VexDay Proof

U&M Software Event Lister 1.0 - Authentication Bypass

CVE-2008-6719—webappsphp

U&M Software Event Lister (aka JustListIt) 1.0 does not require administrative authentication for all scripts in the adm

23RIESGO

abrir ↗

Referência✓ VexDay Proof

zFeeder 1.6 - 'admin.php' Admin Bypass

CVE-2009-0807—webappsphp

zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php.

23RIESGO

abrir ↗

Referência

CVE-2010-1653

CVE-2010-1653—

Directory traversal vulnerability in graphics.php in the Graphics (com_graphics) component 1.0.6 and 1.5.0 for Joomla! a

43RIESGO

abrir ↗

Referência

CVE-2007-1107

CVE-2007-1107—

SQL injection vulnerability in thumbnails.php in Coppermine Photo Gallery (CPG) 1.3.x allows remote authenticated users

23RIESGO

abrir ↗

Referência

CVE-2015-0919

CVE-2015-0919—

Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrator

23RIESGO

abrir ↗

Referência

CVE-2015-3214

CVE-2015-3214—

The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read

23RIESGO

abrir ↗

Referência

CVE-2021-27635

CVE-2021-27635CRITICAL

SAP NetWeaver AS for JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker authenticated as an administrator

48RIESGO

abrir ↗

Referência

CVE-2026-97869

CVE-2026-97869LOW

langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization

28RIESGO

abrir ↗

Referência✓ VexDay Proof

Scribe 0.2 - 'index.php' Local File Inclusion

CVE-2008-0822—webappsphp

Directory traversal vulnerability in index.php in Scribe 0.2 allows remote attackers to read arbitrary local files via a

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Alstrasoft AskMe Pro 2.1 - Multiple SQL Injections

CVE-2008-2857—webappsphp

AlstraSoft AskMe Pro 2.1 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent a

23RIESGO

abrir ↗

Referência✓ VexDay Proof

AyeView 2.20 - '.GIF' Image Local Crash

CVE-2008-5884—doswindows

AyeView 2.20 allows user-assisted attackers to cause a denial of service (application crash) via a GIF file with a malfo

23RIESGO

abrir ↗

Referência✓ VexDay Proof

MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting

CVE-2008-6193—webappsphp

Sam Crew MyBlog stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain se

23RIESGO

abrir ↗

Referência✓ VexDay Proof

TurnkeyForms Entertainment Portal 2.0 - Insecure Cookie Handling

CVE-2008-6723—webappsphp

TurnkeyForms Entertainment Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Bitweaver 2.6 - 'saveFeed()' Remote Code Execution

CVE-2009-1677—webappsphp

Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 an

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Online Grades & Attendance 3.2.6 - Multiple Local File Inclusions

CVE-2009-2037—webappsphp

Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when r

23RIESGO

abrir ↗

Referência

CVE-2010-2028

CVE-2010-2028—

Buffer overflow in k23productions TFTPUtil GUI (aka TFTPGUI) 1.4.5 allows remote attackers to cause a denial of service

28RIESGO

abrir ↗

Referência

CVE-2013-3739

CVE-2013-3739—

Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read

23RIESGO

abrir ↗

Referência

CVE-2015-1576

CVE-2015-1576—

Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands vi

23RIESGO

abrir ↗

Referência

CVE-2012-1069

CVE-2012-1069—

Cross-site scripting (XSS) vulnerability in module/kb/search_word in the search module in lknSupport allows remote attac

23RIESGO

abrir ↗

Referência

CVE-2015-5531

CVE-2015-5531—

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp

60RIESGO

abrir ↗

Referência

CVE-2016-8808

CVE-2016-8808—

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

23RIESGO

abrir ↗

Referência

CVE-2026-75784

CVE-2026-75784CRITICAL

TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow

48RIESGO

abrir ↗

Referência

CVE-2018-7319

CVE-2018-7319—

SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.