Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.679exploits catalogados
40.329CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.150Exploit-DB 24.488GitHub PoC 17.946VulnCheck XDB 10.016Nuclei 4547Metasploit 3532✓ solo verificadosrecientespopularesriesgo
26.150 exploits
Referência
CVE-2022-4774
CVE-2022-4774CRITICAL
Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload
48RIESGO
abrir ↗
Referência
CVE-2026-9572
CVE-2026-9572MEDIUM
GPAC MP4Box media.c Media_GetSample memory leak
33RIESGO
abrir ↗
Referência
CVE-2026-94263
CVE-2026-94263MEDIUM
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message
33RIESGO
abrir ↗
Referência
CVE-2017-15968
CVE-2017-15968—
MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Redaxo 3.2 - 'INCLUDE_PATH' Remote File Inclusion
CVE-2006-2843—webappsphp
PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL
23RIESGO
abrir ↗
Referência★ 7
CVE-2025-0364: BigAnt Server RCE Exploit
CVE-2025-0364CRITICAL
BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE
48RIESGO
abrir ↗
Referência
CVE-2010-1983
CVE-2010-1983—
Directory traversal vulnerability in the redTWITTER (com_redtwitter) component 1.0.x including 1.0b11 for Joomla! allows
43RIESGO
abrir ↗
Referência
CVE-2014-8507
CVE-2014-8507—
Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/Wap
23RIESGO
abrir ↗
Referência
CVE-2017-15968
CVE-2017-15968—
MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Click N Print Coupons 2006.01 - 'key' SQL Injection
CVE-2006-6859—webappsasp
SQL injection vulnerability in coupon_detail.asp in Website Designs For Less Click N' Print Coupons 2005.01 and earlier
23RIESGO
abrir ↗
Referência✓ VexDay Proof
otscms 2.1.5 - SQL Injection / Cross-Site Scripting
CVE-2007-0846—webappsphp
Cross-site scripting (XSS) vulnerability in forum.php in Open Tibia Server CMS (OTSCMS) 2.1.5 and earlier allows remote
23RIESGO
abrir ↗
Referência✓ VexDay Proof
GL-SH Deaf Forum 6.4.4 - Local File Inclusion
CVE-2007-3535—webappsphp
Multiple directory traversal vulnerabilities in GL-SH Deaf Forum 6.4.4 and earlier allow remote attackers to include and
23RIESGO
abrir ↗
Referência
CVE-2018-25371
CVE-2018-25371HIGH
mooSocial Store Plugin 2.6 SQL Injection via product parameter
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Pluxml 0.3.1 - Remote Code Execution
CVE-2007-3542—webappsphp
Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary w
23RIESGO
abrir ↗
Referência
CVE-2018-25370
CVE-2018-25370MEDIUM
Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php
33RIESGO
abrir ↗
Referência
CVE-2018-25369
CVE-2018-25369MEDIUM
Visual Ping 0.8.0.0 Buffer Overflow Denial of Service
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Alstrasoft Article Manager Pro 1.6 - Authentication Bypass
CVE-2008-5649—webappsphp
SQL injection vulnerability in admin/admin.php in AlstraSoft Article Manager Pro 1.6 allows remote attackers to execute
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Virtue Shopping Mall - 'cid' SQL Injection
CVE-2009-2016—webappsphp
SQL injection vulnerability in products.php in Virtue Shopping Mall allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência
CVE-2009-2772
CVE-2009-2772—
Multiple cross-site scripting (XSS) vulnerabilities in PG Roommate Finder Solution allow remote attackers to inject arbi
23RIESGO
abrir ↗
Referência
CVE-2016-9111
CVE-2016-9111—
Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication r
23RIESGO
abrir ↗
Referência
CVE-2025-55241
CVE-2025-55241CRITICAL
Azure Entra ID Elevation of Privilege Vulnerability
48RIESGO
abrir ↗
Referência✓ VexDay Proof
GPS CMS 1.2 - 'print.asp' SQL Injection
CVE-2007-0554—webappsasp
SQL injection vulnerability in print.asp in Guo Xu Guos Posting System (GPS) 1.2 allows remote attackers to execute arbi
23RIESGO
abrir ↗
Referência
CVE-2018-25368
CVE-2018-25368HIGH
Nord VPN 6.14.31 Denial of Service via Password Field
41RIESGO
abrir ↗
Referência
CVE-2021-4464
CVE-2021-4464CRITICAL
FIberHome AN5506-04-FA / HG6245D Routers Remote Stack Overflow
48RIESGO
abrir ↗
Referência
CVE-2021-4464
CVE-2021-4464CRITICAL
FIberHome AN5506-04-FA / HG6245D Routers Remote Stack Overflow
48RIESGO
abrir ↗
Referência
CVE-2026-78837
CVE-2026-78837HIGH
A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitiv
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Buddy Zone 1.5 - 'view_sub_cat.php?cat_id' SQL Injection
CVE-2007-3549—webappsphp
SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL comma
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Constructr CMS 3.02.5 stable - Multiple Vulnerabilities
CVE-2008-5847—webappsphp
Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent atta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
E-Store Kit-1 < 2 PayPal Edition - 'pid' SQL Injection
CVE-2008-3594—webappsphp
SQL injection vulnerability in viewdetails.php in MagicScripts E-Store Kit-1, E-Store Kit-2, E-Store Kit-1 Pro PayPal Ed
23RIESGO
abrir ↗
Referência
CVE-2015-7247
CVE-2015-7247—
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and
28RIESGO
abrir ↗
← anteriorpágina 287 / 872siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.