Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.899exploits catalogados
40.392CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.190 exploits
Referência
CVE-2016-3081
CVE-2016-3081HIGHbajo ataque
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
100RIESGO
abrir ↗
Referência
CVE-2017-9756
CVE-2017-9756—
The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a d
23RIESGO
abrir ↗
Referência
CVE-2017-9811
CVE-2017-9811—
The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maint
28RIESGO
abrir ↗
Referência
CVE-2026-10690
CVE-2026-10690MEDIUM
wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-10583
CVE-2026-10583MEDIUM
nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery
33RIESGO
abrir ↗
Referência
Tatsu 3.3.11 - Unauthenticated RCE
CVE-2021-25094—webappsphp
Tatsu < 3.3.12 - Unauthenticated RCE
60RIESGO
abrir ↗
Referência
CVE-2021-25155
CVE-2021-25155—
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v
28RIESGO
abrir ↗
Referência✓ VexDay Proof
RunCMS 1.6 - Multiple Vulnerabilities
CVE-2007-6547—webappsphp
RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent
23RIESGO
abrir ↗
Referência
CVE-2026-93956
CVE-2026-93956MEDIUM
olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Fusion Mod freshlinks - 'linkid' SQL Injection
CVE-2008-5074—webappsphp
SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to exec
23RIESGO
abrir ↗
Referência
CVE-2009-3208
CVE-2009-3208—
Multiple SQL injection vulnerabilities in phpfreeBB 1.0 allow remote attackers to execute arbitrary SQL commands via the
23RIESGO
abrir ↗
Referência
CVE-2009-4726
CVE-2009-4726—
Directory traversal vulnerability in download.php in Quickdev 4 PHP allows remote attackers to read arbitrary files via
23RIESGO
abrir ↗
Referência
CVE-2017-17620
CVE-2017-17620—
Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2011-4831
CVE-2011-4831—
Directory traversal vulnerability in webFileBrowser.php in Web File Browser 0.4b14 allows remote authenticated users to
23RIESGO
abrir ↗
Referência
CVE-2010-3458
CVE-2010-3458—
SQL injection vulnerability in lib/toolkit/events/event.section.php in Symphony CMS 2.0.7 and 2.1.1 allows remote attack
23RIESGO
abrir ↗
Referência
CVE-2021-47926
CVE-2021-47926MEDIUM
WordPress Contact Form to Email 1.3.24 Stored XSS
33RIESGO
abrir ↗
Referência
CVE-2021-47925
CVE-2021-47925MEDIUM
CMDBuild 3.3.2 Multiple Stored Cross-Site Scripting
33RIESGO
abrir ↗
Referência
CVE-2021-47924
CVE-2021-47924MEDIUM
WordPress Plugin Ultimate Product Catalogue 5.8.2 Stored XSS via price
33RIESGO
abrir ↗
Referência
CVE-2026-16605
CVE-2026-16605HIGH
MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization
41RIESGO
abrir ↗
Referência
CVE-2018-0492
CVE-2018-0492—
Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.
23RIESGO
abrir ↗
Referência
CVE-2018-0706
CVE-2018-0706—
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
50RIESGO
abrir ↗
Referência
CVE-2026-18901
CVE-2026-18901HIGH
H3C NX15 Web API esps service.add routine
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Mihalism Multi Host 2.0.7 - 'download.php' Remote File Disclosure
CVE-2007-6653—webappsphp
Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary
23RIESGO
abrir ↗
Referência
CVE-2009-4756
CVE-2009-4756—
Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execu
23RIESGO
abrir ↗
Referência
CVE-2026-9517
CVE-2026-9517MEDIUM
hemant6488 CodeIgniter-StudentManagementSystem Student Management addStudentView access control
33RIESGO
abrir ↗
Referência
CVE-2010-3458
CVE-2010-3458—
SQL injection vulnerability in lib/toolkit/events/event.section.php in Symphony CMS 2.0.7 and 2.1.1 allows remote attack
23RIESGO
abrir ↗
Referência
CVE-2011-5040
CVE-2011-5040—
Multiple cross-site scripting (XSS) vulnerabilities in Infoproject Biznis Heroj allow remote attackers to inject arbitra
23RIESGO
abrir ↗
Referência
CVE-2026-114383
CVE-2026-114383CRITICAL
TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow
48RIESGO
abrir ↗
Referência
CVE-2017-17870
CVE-2017-17870—
The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action.
23RIESGO
abrir ↗
Referência
CVE-2026-86318
CVE-2026-86318MEDIUM
java-json-tools json-patch JsonMergePatchDeserializer.java JsonMergePatch.fromJson stack-based overflow
33RIESGO
abrir ↗
← anteriorpágina 310 / 873siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.