Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.899exploits catalogados

40.392CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.190 exploits

Referência✓ VexDay Proof

ProQuiz 1.0 - Authentication Bypass

CVE-2008-6312—webappsphp

SQL injection vulnerability in index.php in ProQuiz 1.0 allows remote attackers to execute arbitrary SQL commands via th

23RIESGO

abrir ↗

Referência

CVE-2015-7347

CVE-2015-7347—

Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.

23RIESGO

abrir ↗

Referência

CVE-2011-5262

CVE-2011-5262—

SQL injection vulnerability in prodpage.cfm in SonicWALL Aventail allows remote attackers to execute arbitrary SQL comma

23RIESGO

abrir ↗

Referência

CVE-2026-118585

CVE-2026-118585MEDIUM

configuroweb inventariobasico Add Product addlist.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-118579

CVE-2026-118579CRITICAL

D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor

48RIESGO

abrir ↗

Referência

CVE-2026-115223

CVE-2026-115223MEDIUM

Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block

33RIESGO

abrir ↗

Referência

CVE-2026-110508

CVE-2026-110508MEDIUM

Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification

33RIESGO

abrir ↗

Referência

CVE-2026-106648

CVE-2026-106648MEDIUM

Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes

33RIESGO

abrir ↗

Referência

CVE-2026-67207

CVE-2026-67207HIGH

Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController

41RIESGO

abrir ↗

Referência✓ VexDay Proof

Social Engine 3.06 - 'category_id' SQL Injection

CVE-2009-0400—webappsphp

SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL comm

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Dokuwiki 2009-02-14 - Temporary/Remote File Inclusion

CVE-2009-1960—webappsphp

inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote att

28RIESGO

abrir ↗

Referência

CVE-2010-3461

CVE-2010-3461—

SQL injection vulnerability in the Publisher module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL co

23RIESGO

abrir ↗

Referência

CVE-2010-5026

CVE-2010-5026—

SQL injection vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to e

23RIESGO

abrir ↗

Referência

CVE-2011-4570

CVE-2011-4570—

SQL injection vulnerability in the Time Returns (com_timereturns) component 2.0 and possibly earlier versions for Joomla

23RIESGO

abrir ↗

Referência

CVE-2010-5026

CVE-2010-5026—

SQL injection vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to e

23RIESGO

abrir ↗

Referência

CVE-2012-5288

CVE-2012-5288—

SQL injection vulnerability in page.php in phpMyDirectory 1.3.3 allows remote attackers to execute arbitrary SQL command

23RIESGO

abrir ↗

Referência

CVE-2012-0913

CVE-2012-0913—

SQL injection vulnerability in checklogin.aspx in ICloudCenter ICTimeAttendance 1.0 allows remote attackers to execute a

23RIESGO

abrir ↗

Referência

CVE-2026-14840

CVE-2026-14840MEDIUM

YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing

33RIESGO

abrir ↗

Referência

CVE-2012-0935

CVE-2012-0935—

SQL injection vulnerability in Default.aspx in Aryadad CMS allows remote attackers to execute arbitrary SQL commands via

23RIESGO

abrir ↗

Referência

CVE-2010-5083

CVE-2010-5083—

SQL injection vulnerability in the Web_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL co

23RIESGO

abrir ↗

Referência

CVE-2024-22901

CVE-2024-22901CRITICAL

Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

48RIESGO

abrir ↗

Referência

CVE-2011-4672

CVE-2011-4672—

Multiple SQL injection vulnerabilities in Valid tiny-erp 1.6 and earlier allow remote attackers to execute arbitrary SQL

23RIESGO

abrir ↗

Referência

FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution

CVE-2025-25257CRITICALbajo ataquewebappsmultiple

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi

100RIESGO

abrir ↗

Referência

CVE-2017-13795

CVE-2017-13795—

An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud

23RIESGO

abrir ↗

Referência

CVE-2026-66748

CVE-2026-66748HIGH

Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

41RIESGO

abrir ↗

Referência

CVE-2025-15047

CVE-2025-15047CRITICAL

Tenda WH450 HTTP Request PPTPDClient stack-based overflow

48RIESGO

abrir ↗

Referência

CVE-2025-15047

CVE-2025-15047CRITICAL

Tenda WH450 HTTP Request PPTPDClient stack-based overflow

48RIESGO

abrir ↗

Referência

CVE-2023-0830

CVE-2023-0830MEDIUM

EasyNAS backup.pl system os command injection

38RIESGO

abrir ↗

Referência

CVE-2026-103330

CVE-2026-103330MEDIUM

Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass

33RIESGO

abrir ↗

Referência

CVE-2026-103313

CVE-2026-103313MEDIUM

BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.