Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.899exploits catalogados

40.392CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.190 exploits

Referência

CVE-2026-75148

CVE-2026-75148MEDIUM

cgltf 1.15 Integer Overflow via cgltf_validate() Accessor Bounds Check

13RIESGO

abrir ↗

Referência

CVE-2009-2927

CVE-2009-2927—

SQL injection vulnerability in DetailFile.php in DigitalSpinners DS CMS 1.0 allows remote attackers to execute arbitrary

23RIESGO

abrir ↗

Referência

CVE-2009-4583

CVE-2009-4583—

SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitr

23RIESGO

abrir ↗

Referência

CVE-2010-3211

CVE-2010-3211—

Multiple SQL injection vulnerabilities in the JE FAQ Pro (com_jefaqpro) component 1.5.0 for Joomla! allow remote attacke

23RIESGO

abrir ↗

Referência

CVE-2026-8777

CVE-2026-8777MEDIUM

Edimax BR-6428NS POST Request formStaDrvSetup command injection

33RIESGO

abrir ↗

Referência

CVE-2017-20261

CVE-2017-20261HIGH

Joomla! Component Bargain Product VM3 1.0 SQL Injection

41RIESGO

abrir ↗

Referência

CVE-2026-8776

CVE-2026-8776HIGH

Edimax BR-6428NS POST Request formPPTPSetup buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2017-20260

CVE-2017-20260HIGH

Joomla! Component Price Alert 3.0.2 SQL Injection

41RIESGO

abrir ↗

Referência

CVE-2017-17575

CVE-2017-17575—

FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.

23RIESGO

abrir ↗

Referência

CVE-2017-20259

CVE-2017-20259HIGH

Joomla OSDownloads 1.7.4 SQL Injection via item view

41RIESGO

abrir ↗

Referência✓ VexDay Proof

Libera CMS 1.12 - 'cookie' SQL Injection

CVE-2008-4700—webappsphp

SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic_quotes_gpc is disabled, allows remot

23RIESGO

abrir ↗

Referência

CVE-2026-8981

CVE-2026-8981LOW

Lazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTML

28RIESGO

abrir ↗

Referência

CVE-2026-11585

CVE-2026-11585MEDIUM

CodeAstro Student Attendance Management System createClassArms.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2009-4599

CVE-2009-4599—

Multiple SQL injection vulnerabilities in the JS Jobs (com_jsjobs) component 1.0.5.6 for Joomla! allow remote attackers

23RIESGO

abrir ↗

Referência

CVE-2009-4600

CVE-2009-4600—

SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attacke

23RIESGO

abrir ↗

Referência

CVE-2016-2386

CVE-2016-2386CRITICALbajo ataque

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi

100RIESGO

abrir ↗

Referência

CVE-2016-2386

CVE-2016-2386CRITICALbajo ataque

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi

100RIESGO

abrir ↗

Referência

CVE-2026-7315

CVE-2026-7315MEDIUM

eiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal

33RIESGO

abrir ↗

Referência

CVE-2016-2386

CVE-2016-2386CRITICALbajo ataque

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi

100RIESGO

abrir ↗

Referência

CVE-2017-17597

CVE-2017-17597—

Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.

23RIESGO

abrir ↗

Referência

CVE-2026-87924

CVE-2026-87924MEDIUM

Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication

33RIESGO

abrir ↗

Referência

CVE-2026-19035

CVE-2026-19035HIGH

Shibby Tomato qoslimit new_qoslimit_start os command injection

41RIESGO

abrir ↗

Referência✓ VexDay Proof

k_shoutbox 4.4 - Remote File Inclusion

CVE-2006-3989—webappsphp

PHP remote file inclusion vulnerability in index.php in Knusperleicht Shoutbox 4.4 and earlier allows remote attackers t

23RIESGO

abrir ↗

Referência

CVE-2011-4453

CVE-2011-4453—

The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitra

50RIESGO

abrir ↗

Referência

CVE-2016-2784

CVE-2016-2784—

CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduc

23RIESGO

abrir ↗

Referência

CVE-2017-9150

CVE-2017-9150—

The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value

23RIESGO

abrir ↗

Referência

CVE-2026-87923

CVE-2026-87923MEDIUM

Rizwan17 inventory-management-system List DBOperation.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-19009

CVE-2026-19009MEDIUM

TinyAGI Message API Endpoint response.ts collectFiles file inclusion

33RIESGO

abrir ↗

Referência✓ VexDay Proof

QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection

CVE-2008-4772—webappsphp

SQL injection vulnerability in main/main.php in QuestCMS allows remote attackers to execute arbitrary SQL commands via t

23RIESGO

abrir ↗

Referência

CVE-2026-10690

CVE-2026-10690MEDIUM

wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.