Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.899exploits catalogados
40.392CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.190 exploits
Referência
CVE-2008-1349
CVE-2008-1349—
SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows
23RIESGO
abrir ↗
Referência
CVE-2008-1349
CVE-2008-1349—
SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows
23RIESGO
abrir ↗
Referência
CVE-2026-14655
CVE-2026-14655MEDIUM
code-projects Assessment Management view-users.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-14640
CVE-2026-14640MEDIUM
CodeAstro Apartment Visitor Management System Login index.php sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
CPCommerce 1.2.8 - 'id_document' Blind SQL Injection
CVE-2009-1345—webappsphp
SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2026-14639
CVE-2026-14639MEDIUM
CodeAstro Ecommerce Website my_account.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14635
CVE-2026-14635MEDIUM
kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal
33RIESGO
abrir ↗
Referência
CVE-2017-2934
CVE-2017-2934—
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe Te
28RIESGO
abrir ↗
Referência
CVE-2020-11560
CVE-2020-11560—
NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Chupix CMS 0.2.3 - 'download.php' Remote File Disclosure
CVE-2007-4957—webappsphp
Multiple directory traversal vulnerabilities in download.php in Chupix CMS 0.2.3 allow remote attackers to read or overw
23RIESGO
abrir ↗
Referência
CVE-2014-5089
CVE-2014-5089—
SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute
23RIESGO
abrir ↗
Referência
CVE-2010-0709
CVE-2010-0709—
Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authent
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ProfileCMS 1.0 - 'id' SQL Injection
CVE-2007-6058—webappsphp
Multiple SQL injection vulnerabilities in index.php in ProfileCMS 1.0 and earlier allow remote attackers to execute arbi
23RIESGO
abrir ↗
Referência
CVE-2010-0709
CVE-2010-0709—
Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authent
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection
CVE-2007-6656—webappsphp
SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote
23RIESGO
abrir ↗
Referência
CVE-2009-4616
CVE-2009-4616—
Cross-site scripting (XSS) vulnerability in search.php in MYRE Holiday Rental Manager allows remote attackers to inject
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Brim 2.0.0 - SQL Injection / Cross-Site Scripting
CVE-2008-4083—webappsphp
Cross-site scripting (XSS) vulnerability in the Bookmarks plugin in Brim 2.0 allows remote authenticated users to inject
23RIESGO
abrir ↗
Referência
CVE-2015-8635
CVE-2015-8635—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Elecard AVC HD Player - '.XPL' Stack Buffer Overflow (SEH) (PoC)
CVE-2009-1356—doswindows
Stack-based buffer overflow in Elecard AVC HD Player allows remote attackers to execute arbitrary code via a long MP3 fi
23RIESGO
abrir ↗
Referência
CVE-2020-25540
CVE-2020-25540—
ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on
60RIESGO
abrir ↗
Referência
CVE-2017-11823
CVE-2017-11823—
The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security
23RIESGO
abrir ↗
Referência
CVE-2026-102491
CVE-2026-102491MEDIUM
mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection
33RIESGO
abrir ↗
Referência
CVE-2006-3362
CVE-2006-3362—
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) G
23RIESGO
abrir ↗
Referência
CVE-2026-102570
CVE-2026-102570HIGH
ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-96762
CVE-2026-96762MEDIUM
kvcache-ai mooncake RPC Path UnmountSegment authorization
33RIESGO
abrir ↗
Referência✓ VexDay Proof
AJ Forum 1.0 - 'topic_title.php' SQL Injection
CVE-2007-1295—webappsphp
SQL injection vulnerability in topic_title.php in AJ Forum 1.0 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2009-3191
CVE-2009-3191—
Multiple cross-site scripting (XSS) vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to inject arbitrary w
23RIESGO
abrir ↗
Referência
CVE-2010-2906
CVE-2010-2906—
SQL injection vulnerability in articlesdetails.php in ScriptsFeed and BrotherScripts (BS) Scripts Directory allows remot
23RIESGO
abrir ↗
Referência
CVE-2010-1344
CVE-2010-1344—
SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attacke
23RIESGO
abrir ↗
Referência
CVE-2010-1344
CVE-2010-1344—
SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attacke
23RIESGO
abrir ↗
← anteriorpágina 308 / 873siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.