Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.693exploits catalogados
40.332CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.150Exploit-DB 24.488GitHub PoC 17.946VulnCheck XDB 10.016Nuclei 4556Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.150 exploits
Referência✓ VexDay Proof
Flyspeck CMS 6.8 - Local/Remote File Inclusion / Change Add Admin
index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which
23RIESGO
abrir ↗Referência
CVE-2009-2340
SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands vi
23RIESGO
abrir ↗Referência
CVE-2010-1722
Directory traversal vulnerability in the Online Market (com_market) component 2.x for Joomla! allows remote attackers to
38RIESGO
abrir ↗Referência
CVE-2023-27040
Simple Image Gallery v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the username paramet
48RIESGO
abrir ↗Referência
CVE-2018-18858
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RIESGO
abrir ↗Referência
RAD SecFlow-1v SF_0290_2.3.01.26 - Persistent Cross-Site Scripting
A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated
23RIESGO
abrir ↗Referência
CVE-2026-15206
SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile
41RIESGO
abrir ↗Referência
CVE-2017-0115
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RIESGO
abrir ↗Referência✓ VexDay Proof
XOOPS Module XFsection 1.07 - 'articleId' Blind SQL Injection
SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as
23RIESGO
abrir ↗Referência✓ VexDay Proof
Barracuda Spam Firewall 3.5.11.020 Model 600 - SQL Injection
SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall (BSF) before 3.5.12.007 all
23RIESGO
abrir ↗Referência✓ VexDay Proof
Angelo-Emlak 1.0 - Multiple SQL Injections
Cross-site scripting (XSS) vulnerability in hpz/admin/Default.asp in Angelo-Emlak 1.0 allows remote attackers to inject
23RIESGO
abrir ↗Referência✓ VexDay Proof
W1L3D4 philboard 1.2 - Blind SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to injec
23RIESGO
abrir ↗Referência✓ VexDay Proof
phpcrs 2.06 - 'importFunction' Local File Inclusion
Directory traversal vulnerability in frame.php in phpcrs 2.06 and earlier, when magic_quotes_gpc is disabled, allows rem
23RIESGO
abrir ↗Referência
CVE-2009-3715
Multiple SQL injection vulnerabilities in scr_login.php in MCshoutbox 1.1, when magic_quotes_gpc is disabled, allow remo
23RIESGO
abrir ↗Referência
CVE-2010-1702
SQL injection vulnerability in submitticket.php in WHMCompleteSolution (WHMCS) 4.2 allows remote attackers to execute ar
23RIESGO
abrir ↗Referência✓ VexDay Proof
Yet Another NOCC 0.1.0 - Local File Inclusion
Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attacke
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, wh
23RIESGO
abrir ↗Referência
CVE-2009-2218
Multiple PHP remote file inclusion vulnerabilities in phpCollegeExchange 0.1.5c, when register_globals is enabled, allow
23RIESGO
abrir ↗Referência
CVE-2015-6516
SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitra
23RIESGO
abrir ↗Referência
CVE-2009-3186
Multiple cross-site scripting (XSS) vulnerabilities in VideoGirls BiZ allow remote attackers to inject arbitrary web scr
23RIESGO
abrir ↗Referência
CVE-2009-3359
Multiple cross-site scripting (XSS) vulnerabilities in Match Agency BiZ 1.0 allow remote attackers to inject arbitrary w
23RIESGO
abrir ↗Referência
CVE-2008-6840
Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP co
23RIESGO
abrir ↗Referência
CVE-2026-8383
LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API
48RIESGO
abrir ↗Referência
CVE-2016-20075
WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCE
41RIESGO
abrir ↗Referência
CVE-2009-4800
Directory traversal vulnerability in Sysax Multi Server 4.3 and 4.5 allows remote authenticated users to delete arbitrar
23RIESGO
abrir ↗Referência
CVE-2020-7108
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
23RIESGO
abrir ↗Referência
CVE-2013-4863
The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute a
28RIESGO
abrir ↗Referência
CVE-2016-0964
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on
28RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.