Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.634exploits catalogados

40.286CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.110Exploit-DB 24.488GitHub PoC 17.941VulnCheck XDB 10.016Nuclei 4547Metasploit 3532✓ solo verificadosrecientes populares riesgo

26.110 exploits

Referência

CVE-2026-101262

CVE-2026-101262CRITICAL

Ziroom ZHOME A0101 set_online_client command injection

48RIESGO

abrir ↗

Referência✓ VexDay Proof

jGallery 1.3 - 'index.php' Remote File Inclusion

CVE-2007-2158—webappsphp

PHP remote file inclusion vulnerability in index.php in jGallery 1.3 allows remote attackers to execute arbitrary PHP co

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Squirrelcart 1.x - 'cart.php' Remote File Inclusion

CVE-2007-4439—webappsphp

PHP remote file inclusion vulnerability in popup_window.php in Squirrelcart 1.x.x and earlier allows remote attackers to

23RIESGO

abrir ↗

Referência

CVE-2026-70619

CVE-2026-70619HIGH

Odysseus Missing Admin Authorization via Embedding Endpoint Routes

41RIESGO

abrir ↗

Referência

CVE-2010-0674

CVE-2010-0674—

StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote at

23RIESGO

abrir ↗

Referência

CVE-2010-0939

CVE-2010-0939—

Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows re

23RIESGO

abrir ↗

Referência✓ VexDay Proof

PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload

CVE-2008-1506—webappsphp

PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpi

23RIESGO

abrir ↗

Referência

CVE-2010-0939

CVE-2010-0939—

Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows re

23RIESGO

abrir ↗

Referência

CVE-2010-2721

CVE-2010-2721—

SQL injection vulnerability in index.php in RightInPoint Lyrics Script 3.0 allows remote attackers to execute arbitrary

23RIESGO

abrir ↗

Referência

CVE-2010-2721

CVE-2010-2721—

SQL injection vulnerability in index.php in RightInPoint Lyrics Script 3.0 allows remote attackers to execute arbitrary

23RIESGO

abrir ↗

Referência

CVE-2012-6048

CVE-2012-6048—

Guitar Pro 6.1.1 r10791 allows remote attackers to cause a denial of service (crash) via a long string in a gpx file.

23RIESGO

abrir ↗

Referência

CVE-2010-0674

CVE-2010-0674—

StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote at

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Zomplog 3.8.2 - 'newuser.php' Arbitrary Add Admin

CVE-2008-2349—webappsphp

Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direc

23RIESGO

abrir ↗

Referência

CVE-2015-6519

CVE-2015-6519—

SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail

23RIESGO

abrir ↗

Referência

CVE-2015-6541

CVE-2015-6541—

Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) be

23RIESGO

abrir ↗

Referência✓ VexDay Proof

clickandemail - SQL Injection / Cross-Site Scripting

CVE-2008-5892—webappsasp

Multiple SQL injection vulnerabilities in ClickAndEmail allow remote attackers to execute arbitrary SQL commands via (1)

23RIESGO

abrir ↗

Referência✓ VexDay Proof

webid 0.5.4 - Multiple Vulnerabilities

CVE-2008-7118—webappsphp

WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allow

23RIESGO

abrir ↗

Referência✓ VexDay Proof

RM Downloader 3.0.0.9 - '.m3u' Universal Stack Overflow

CVE-2009-1326—localwindows

Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a

23RIESGO

abrir ↗

Referência

CVE-2009-2263

CVE-2009-2263—

Directory traversal vulnerability in index.php in Awesome PHP Mega File Manager 1.0 allows remote attackers to include a

23RIESGO

abrir ↗

Referência

CVE-2010-0765

CVE-2010-0765—

fipsForum 2.6 stores sensitive information under the web root with insufficient access control, which allows remote atta

23RIESGO

abrir ↗

Referência

CVE-2010-1047

CVE-2010-1047—

SQL injection vulnerability in index.php in MASA2EL Music City 1.0 and 1.1 allows remote attackers to execute arbitrary

23RIESGO

abrir ↗

Referência

CVE-2013-10042

CVE-2013-10042CRITICAL

freeFTPd <= 1.0.10 PASS Command Stack-Based Buffer Overflow

63RIESGO

abrir ↗

Referência

CVE-2013-10042

CVE-2013-10042CRITICAL

freeFTPd <= 1.0.10 PASS Command Stack-Based Buffer Overflow

63RIESGO

abrir ↗

Referência

CVE-2018-11442

CVE-2018-11442—

A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= U

23RIESGO

abrir ↗

Referência

CVE-2018-0832

CVE-2018-0832—

The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Window

23RIESGO

abrir ↗

Referência

CVE-2019-0555

CVE-2019-0555—

An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape

23RIESGO

abrir ↗

Referência

CVE-2019-1170

CVE-2019-1170HIGH

Windows NTFS Elevation of Privilege Vulnerability

41RIESGO

abrir ↗

Referência

CVE-2020-15149

CVE-2020-15149CRITICAL

Account takeover in NodeBB

48RIESGO

abrir ↗

Referência

CVE-2013-0803

CVE-2013-0803—

A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arb

60RIESGO

abrir ↗

Referência★ 1

Sanitized XenForo write-up and proof of concept for CVE-2026-73317.

CVE-2026-73317MEDIUM

XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.