Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.899exploits catalogados
40.392CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.190 exploits
Referência
CVE-2011-10013
CVE-2011-10013CRITICAL
Traq 2.0–2.3 admincp/common.php RCE
63RIESGO
abrir ↗
Referência
CVE-2009-2332
CVE-2009-2332—
CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to in
23RIESGO
abrir ↗
Referência
CVE-2010-1361
CVE-2010-1361—
Cross-site scripting (XSS) vulnerability in shop/USER_ARTIKEL_HANDLING_AUFRUF.php in PHPepperShop 2.5 allows remote atta
23RIESGO
abrir ↗
Referência
CVE-2013-7274
CVE-2013-7274—
Cross-site scripting (XSS) vulnerability in Wallpaper Script 3.5.0082 allows remote authenticated users to inject arbitr
23RIESGO
abrir ↗
Referência
CVE-2015-7707
CVE-2015-7707—
Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter
23RIESGO
abrir ↗
Referência
CVE-2017-17571
CVE-2017-17571—
FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17572
CVE-2017-17572—
FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari.
23RIESGO
abrir ↗
Referência
CVE-2026-32985
CVE-2026-32985CRITICAL
Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution
63RIESGO
abrir ↗
Referência
CVE-2022-25630
CVE-2022-25630MEDIUM
An authenticated user can embed malicious content with XSS into the admin group policy page.
33RIESGO
abrir ↗
Referência
CVE-2026-110069
CVE-2026-110069MEDIUM
Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions
33RIESGO
abrir ↗
Referência
CVE-2017-17586
CVE-2017-17586—
FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Rankem - File Disclosure / Cross-Site Scripting / Cookie
CVE-2009-0248—webappsphp
Cross-site scripting (XSS) vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrar
23RIESGO
abrir ↗
Referência
CVE-2026-110035
CVE-2026-110035MEDIUM
Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route
33RIESGO
abrir ↗
Referência
CVE-2026-19454
CVE-2026-19454MEDIUM
JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
33RIESGO
abrir ↗
Referência
CVE-2026-81835
CVE-2026-81835MEDIUM
RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection
33RIESGO
abrir ↗
Referência
CVE-2026-110033
CVE-2026-110033MEDIUM
Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'
33RIESGO
abrir ↗
Referência
CVE-2016-1525
CVE-2016-1525—
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RIESGO
abrir ↗
Referência
CVE-2026-19225
CVE-2026-19225MEDIUM
Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite
33RIESGO
abrir ↗
Referência✓ VexDay Proof
AdaptCMS Lite 1.4 - Cross-Site Scripting / Remote File Inclusion
CVE-2009-0527—webappsphp
PHP remote file inclusion vulnerability in plugins/rss_importer_functions.php in AdaptCMS Lite 1.4 allows remote attacke
23RIESGO
abrir ↗
Referência
CVE-2020-37169
CVE-2020-37169MEDIUM
WordPress Plugin ultimate-member 2.1.3 Local File Inclusion
33RIESGO
abrir ↗
Referência
CVE-2010-2359
CVE-2010-2359—
SQL injection vulnerability in eWebQuiz.asp in ActiveWebSoftwares.com eWebquiz 8 allows remote attackers to execute arbi
23RIESGO
abrir ↗
Referência
CVE-2010-3858
CVE-2010-3858—
The setup_arg_pages function in fs/exec.c in the Linux kernel before 2.6.36, when CONFIG_STACK_GROWSDOWN is used, does n
23RIESGO
abrir ↗
Referência
CVE-2017-17587
CVE-2017-17587—
FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or c
23RIESGO
abrir ↗
Referência
CVE-2009-2423
CVE-2009-2423—
SQL injection vulnerability in category.php in Ebay Clone 2009 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2009-2427
CVE-2009-2427—
SQL injection vulnerability in co-profile.php in Jobbr 2.2.7 allows remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗
Referência
CVE-2010-2016
CVE-2010-2016—
SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência
CVE-2009-2437
CVE-2009-2437—
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Rentventory 1.0.1 allow remote attackers to inject a
23RIESGO
abrir ↗
Referência
CVE-2010-3895
CVE-2010-3895—
esRunCommand in IBM OmniFind Enterprise Edition before 9.1 allows local users to gain privileges by specifying an arbitr
23RIESGO
abrir ↗
Referência
CVE-2012-6518
CVE-2012-6518—
Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authenti
23RIESGO
abrir ↗
Referência
CVE-2013-2639
CVE-2013-2639—
Cross-site scripting (XSS) vulnerability in CTERA Cloud Storage OS before 3.2.29.0, 3.2.42.0, and earlier allows remote
23RIESGO
abrir ↗
← anteriorpágina 305 / 873siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.