Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.899exploits catalogados
40.392CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.190 exploits
Referência✓ VexDay Proof
Alstrasoft e-Friends 4.21 - Admin Session Retrieve
SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute ar
23RIESGO
abrir ↗Referência✓ VexDay Proof
Microsoft Excel 2000/2003 - Sheet Name (PoC)
Unspecified vulnerability in Microsoft Excel 2003 SP2 allows remote attackers to have an unknown impact via unspecified
35RIESGO
abrir ↗Referência✓ VexDay Proof
Interact 2.4.1 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Interact Learning Community Environment Interact 2.4.1, when regis
23RIESGO
abrir ↗Referência✓ VexDay Proof
cmsWorks 2.2 RC4 - 'mod_root' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_globals is en
23RIESGO
abrir ↗Referência
CVE-2010-5048
Cross-site scripting (XSS) vulnerability in admin.jcomments.php in the JoomlaTune JComments (com_jcomments) component 2.
23RIESGO
abrir ↗Referência
CVE-2012-2938
Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow remote attackers to inject arbitrary
23RIESGO
abrir ↗Referência
CVE-2012-5700
Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitra
23RIESGO
abrir ↗Referência
CVE-2010-2138
Multiple directory traversal vulnerabilities in ProMan 0.1.1 and earlier allow remote attackers to include and execute a
23RIESGO
abrir ↗Referência
CVE-2015-2999
Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary
23RIESGO
abrir ↗Referência
CVE-2016-1077
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acro
28RIESGO
abrir ↗Referência✓ VexDay Proof
Free Hosting Manager 1.2/2.0 - Insecure Cookie Handling
Free Hosting Manager 1.2 and 2.0 allows remote attackers to bypass authentication and gain administrative access by sett
23RIESGO
abrir ↗Referência✓ VexDay Proof
iFdate 2.0.3 - SQL Injection
SQL injection vulnerability in members_search.php in iFusion Services iFdate 2.0.3 and earlier allows remote attackers t
23RIESGO
abrir ↗Referência
CVE-2010-1858
Directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote atta
43RIESGO
abrir ↗Referência
CVE-2014-10033
SQL injection vulnerability in the update_zone function in catalog/admin/geo_zones.php in osCommerce Online Merchant 2.3
23RIESGO
abrir ↗Referência
CVE-2018-19750
DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Doma
23RIESGO
abrir ↗Referência
CVE-2015-1423
Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL com
23RIESGO
abrir ↗Referência
CVE-2025-34056
AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution
48RIESGO
abrir ↗Referência
CVE-2025-34056
AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution
48RIESGO
abrir ↗Referência
CVE-2016-3136
The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically p
23RIESGO
abrir ↗Referência
CVE-2017-0146
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗Referência
CVE-2017-15727
In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
23RIESGO
abrir ↗Referência
CVE-2017-8838
XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380h
23RIESGO
abrir ↗Referência
CVE-2018-11403
DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.
23RIESGO
abrir ↗Referência
CVE-2009-4658
Xerver 4.32 allows remote authenticated users to cause a denial of service (daemon crash) via a non-numeric web port ass
23RIESGO
abrir ↗Referência
CVE-2026-9608
QianFox FoxCMS Administrator Backend edit cross site scripting
33RIESGO
abrir ↗Referência
CVE-2015-1423
Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL com
23RIESGO
abrir ↗Referência
CVE-2017-0146
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗Referência✓ VexDay Proof
ArcadeBuilder Game Portal Manager 1.7 - SQL Injection
SQL injection vulnerability in ArcadeBuilder Game Portal Manager 1.7 allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗Referência
CVE-2017-15959
Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-200
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.