Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.899exploits catalogados
40.392CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.190 exploits
Referência
CVE-2020-8778
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document,
23RIESGO
abrir ↗Referência
CVE-2026-90623
andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation
33RIESGO
abrir ↗Referência
CVE-2026-90622
GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference
33RIESGO
abrir ↗Referência✓ VexDay Proof
Philex 0.2.3 - Remote File Inclusion / File Disclosure
download.php in Philex 0.2.3 and earlier allows remote attackers to read arbitrary files and source code, and obtain sen
23RIESGO
abrir ↗Referência✓ VexDay Proof
Noticeware Email Server 4.6.1.0 - Denial of Service
MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application cras
23RIESGO
abrir ↗Referência✓ VexDay Proof
Scientific Image DataBase 0.41 - Blind SQL Injection
SQL injection vulnerability in projects.php in Scientific Image DataBase 0.41 allows remote attackers to execute arbitra
23RIESGO
abrir ↗Referência✓ VexDay Proof
e107 < 0.7.13 - 'usersettings.php' Blind SQL Injection
SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute
23RIESGO
abrir ↗Referência
CVE-2015-2084
Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote
23RIESGO
abrir ↗Referência
CVE-2017-9813
In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptNa
23RIESGO
abrir ↗Referência✓ VexDay Proof
Online Grades 3.2.4 - Authentication Bypass
Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, whi
23RIESGO
abrir ↗Referência✓ VexDay Proof
Orbit Downloader 2.8.7 - Arbitrary File Deletion
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allow
23RIESGO
abrir ↗Referência
CVE-2009-4991
Cross-site scripting (XSS) vulnerability in users/resume_register.php in Omnistar Recruiting allows remote attackers to
23RIESGO
abrir ↗Referência
CVE-2010-0764
SQL injection vulnerability in index.php in KuwaitPHP eSmile allows remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗Referência
CVE-2010-1544
micro_httpd on the RCA DCM425 cable modem allows remote attackers to cause a denial of service (device reboot) via a lon
23RIESGO
abrir ↗Referência
CVE-2015-2084
Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote
23RIESGO
abrir ↗Referência
CVE-2010-0796
SQL injection vulnerability in the JE Quiz (com_jequizmanagement) component 1.b01 for Joomla! allows remote attackers to
23RIESGO
abrir ↗Referência
CVE-2010-1055
Multiple PHP remote file inclusion vulnerabilities in osDate 2.1.9 and 2.5.4, when magic_quotes_gpc is disabled and regi
23RIESGO
abrir ↗Referência
CVE-2025-44868
Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.
48RIESGO
abrir ↗Referência
CVE-2008-0230
PHP remote file inclusion vulnerability in php121db.php in osDate 2.0.8 and possibly earlier versions allows remote atta
23RIESGO
abrir ↗Referência
CVE-2024-8162
TOTOLINK T10 AC1200 Telnet Service product.ini hard-coded credentials
48RIESGO
abrir ↗Referência
CVE-2018-16736
In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters sec
23RIESGO
abrir ↗Referência
CVE-2019-9554
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at
23RIESGO
abrir ↗Referência
CVE-2022-35155
Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the s
33RIESGO
abrir ↗Referência
CVE-2024-25004
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insuf
41RIESGO
abrir ↗Referência
CVE-2013-7278
SQL injection vulnerability in Naxtech CMS Afroditi 1.0 allows remote attackers to execute arbitrary SQL commands via th
23RIESGO
abrir ↗Referência
CVE-2026-90610
GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read
33RIESGO
abrir ↗Referência
CVE-2026-14843
Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR
33RIESGO
abrir ↗Referência
CVE-2012-6559
Multiple cross-site scripting (XSS) vulnerabilities in FreeNAC 3.02 allow remote attackers to inject arbitrary web scrip
23RIESGO
abrir ↗Referência✓ VexDay Proof
Techno Dreams Articles & Papers 2.0 - SQL Injection
SQL injection vulnerability in ArticlesTableview.asp in Techno Dreams Articles & Papers Package 2.0 and earlier allows r
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.