Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.899exploits catalogados
40.392CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.190 exploits
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6497—webappsasp
Hosting Controller 6.1 Hot fix 3.3 and earlier (1) allows remote attackers to change arbitrary user profiles via a reque
23RIESGO
abrir ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6498—webappsasp
Multiple SQL injection vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated user
23RIESGO
abrir ↗
Referência
CVE-2009-4621
CVE-2009-4621—
SQL injection vulnerability in the JiangHu Inn plugin 1.1 and earlier for Discuz! allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência
CVE-2009-3057
CVE-2009-3057—
Multiple cross-site scripting (XSS) vulnerabilities in AOM Software Beex 3 allow remote attackers to inject arbitrary we
23RIESGO
abrir ↗
Referência
CVE-2010-4142
CVE-2010-4142—
Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a
50RIESGO
abrir ↗
Referência
CVE-2009-4622
CVE-2009-4622—
PHP remote file inclusion vulnerability in admin/admin_news_bot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows
23RIESGO
abrir ↗
Referência
CVE-2026-18395
CVE-2026-18395MEDIUM
Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes
33RIESGO
abrir ↗
Referência
CVE-2010-4144
CVE-2010-4144—
SQL injection vulnerability in radyo.asp in Kisisel Radyo Script allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2026-10875
CVE-2026-10875MEDIUM
projectworlds Online Art Gallery Shop Project adminHome.ph sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10874
CVE-2026-10874MEDIUM
projectworlds Online Art Gallery Shop Project adminHome.php sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
HP Software Update Client 3.0.8.4 - Multiple Vulnerabilities
CVE-2007-6506—doswindows
The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlie
28RIESGO
abrir ↗
Referência
CVE-2009-4661
CVE-2009-4661—
Multiple buffer overflows in BigAnt Server 2.50 SP6 and earlier allow user-assisted remote attackers to cause a denial o
23RIESGO
abrir ↗
Referência
CVE-2010-3404
CVE-2010-3404—
Multiple SQL injection vulnerabilities in eshtery CMS (aka eshtery.com) allow remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2016-3716
CVE-2016-3716—
The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via
28RIESGO
abrir ↗
Referência
CVE-2026-49136
CVE-2026-49136HIGH
Banana Slides 0.4.0 Path Traversal via generate_image() in ai_service.py
21RIESGO
abrir ↗
Referência
CVE-2026-43624
CVE-2026-43624HIGH
F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project()
21RIESGO
abrir ↗
Referência
CVE-2026-43623
CVE-2026-43623HIGH
microtar 0.1.0 Stack-Based Buffer Overflow via raw_to_header()
21RIESGO
abrir ↗
Referência
CVE-2017-20289
CVE-2017-20289HIGH
Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter
41RIESGO
abrir ↗
Referência
CVE-2026-16055
CVE-2026-16055HIGH
Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login
41RIESGO
abrir ↗
Referência
CVE-2017-17623
CVE-2017-17623—
Opensource Classified Ads Script 3.2 has SQL Injection via the advance_result.php keyword parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-20289
CVE-2017-20289HIGH
Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter
41RIESGO
abrir ↗
Referência
CVE-2021-26084
CVE-2021-26084CRITICALbajo ataqueransomware
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RIESGO
abrir ↗
Referência
CVE-2017-20287
CVE-2017-20287HIGH
Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-111971
CVE-2026-111971MEDIUM
Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
33RIESGO
abrir ↗
Referência
CVE-2010-4232
CVE-2010-4232—
The web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera
23RIESGO
abrir ↗
Referência
CVE-2017-17623
CVE-2017-17623—
Opensource Classified Ads Script 3.2 has SQL Injection via the advance_result.php keyword parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-109927
CVE-2026-109927HIGH
CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role
41RIESGO
abrir ↗
Referência✓ VexDay Proof
1024 CMS 1.3.1 - Local File Inclusion / SQL Injection
CVE-2007-6583—webappsphp
SQL injection vulnerability in admin/ops/findip/ajax/search.php in 1024 CMS 1.3.1 allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência
Sanitized XenForo write-up and proof of concept for CVE-2026-73312.
CVE-2026-73312CRITICAL
XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
48RIESGO
abrir ↗
Referência
CVE-2010-3428
CVE-2010-3428—
SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute
23RIESGO
abrir ↗
← anteriorpágina 297 / 873siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.