Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.966exploits catalogados
40.449CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.032VulnCheck XDB 10.108Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2026-78060
CVE-2026-78060MEDIUM
SourceCodester Stock Management System getOrderReport.php cross site scripting
33RIESGO
abrir ↗
Referência★ 1
CVE-2026-67620 - Flowise SSRF via incomplete cloud-metadata deny-list (Oracle OCI 192.0.0.192 + Alibaba 100.100.100.200 bypass the DEFAULT_DENY_LIST)
CVE-2026-67620MEDIUM
Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List
33RIESGO
abrir ↗
Referência
CVE-2026-49114
CVE-2026-49114MEDIUM
ONNX symlink-following and path-traversal arbitrary file write
33RIESGO
abrir ↗
Referência
CVE-2026-16608
CVE-2026-16608MEDIUM
Download Monitor < 5.2.6 - Unauthenticated Download Log Injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
OPENi-CMS Site Protection Plugin - Remote File Inclusion
CVE-2007-0881—webappsphp
PHP remote file inclusion vulnerability in the Seitenschutz plugin for OPENi-CMS 1.0 allows remote attackers to execute
23RIESGO
abrir ↗
Referência
CVE-2017-6090
CVE-2017-6090—
Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authentica
60RIESGO
abrir ↗
Referência
CVE-2017-6095
CVE-2017-6095—
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/list
23RIESGO
abrir ↗
Referência
AirDroid 4.2.1.6 - Denial of Service
CVE-2019-9599—dosandroid
The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash
28RIESGO
abrir ↗
Referência
CVE-2020-0796
CVE-2020-0796CRITICALbajo ataqueransomware
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RIESGO
abrir ↗
Referência✓ VexDay Proof
DoceboLms 2.0.5 - 'help.php' Remote File Inclusion
CVE-2006-2668—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP co
23RIESGO
abrir ↗
Referência
MCL-Net 4.3.5.8788 - Information Disclosure
CVE-2023-34834—webappshardware
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attacker
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Ottoman CMS 1.1.3 - '?default_path=' Remote File Inclusion (1)
CVE-2006-2767—webappsphp
PHP remote file inclusion vulnerability in Ottoman 1.1.2, when register_globals is enabled, allows remote attackers to e
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpCommunityCalendar 4.0.3 - Cross-Site Scripting / SQL Injection
CVE-2006-2798—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to inject arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
News Bin Pro 5.33 - '.nbi' Local Buffer Overflow
CVE-2007-1074—localwindows
Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TurboFTP Server 5.30 Build 572 - 'newline/LIST' Multiple Remote Denial of Service Vulnerabilities
CVE-2007-1075—doswindows
TurboFTP 5.30 Build 572 allows remote servers to cause a denial of service (CPU consumption) via a response with a large
23RIESGO
abrir ↗
Referência
CVE-2017-6527
CVE-2017-6527—
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal att
50RIESGO
abrir ↗
Referência
CVE-2018-7448
CVE-2018-7448—
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote
28RIESGO
abrir ↗
Referência
CVE-2002-1230
CVE-2002-1230—
NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WebED 0.8999a - Multiple Remote File Inclusions
CVE-2007-4815—webappsphp
Multiple PHP remote file inclusion vulnerabilities in WebED in Markus Iser ED Engine 0.8999 alpha allow remote attackers
35RIESGO
abrir ↗
Referência
CVE-2017-8917
CVE-2017-8917—
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspeci
60RIESGO
abrir ↗
Referência
CVE-2020-13927
CVE-2020-13927CRITICALbajo ataque
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th
100RIESGO
abrir ↗
Referência
CVE-2020-13951
CVE-2020-13951—
Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
35RIESGO
abrir ↗
Referência
CVE-2022-1163
CVE-2022-1163MEDIUM
Cross-site Scripting (XSS) - Stored in mineweb/minewebcms
33RIESGO
abrir ↗
Referência✓ VexDay Proof
BaoFeng2 - 'mps.dll' ActiveX Multiple Remote Buffer Overflows (PoC)
CVE-2007-4816—doswindows
Multiple buffer overflows in the BaoFeng2 storm ActiveX control in Mps.dll allow remote attackers to have an unknown imp
23RIESGO
abrir ↗
Referência
CVE-2002-1966
CVE-2002-1966—
Directory traversal vulnerability in magiccard.cgi in My Postcards Platinum 5.0 and 6.0 allows remote attackers to read
23RIESGO
abrir ↗
Referência
CVE-2017-7310
CVE-2017-7310—
A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9
50RIESGO
abrir ↗
Referência
CVE-2026-85015
CVE-2026-85015MEDIUM
Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal
33RIESGO
abrir ↗
Referência
CVE-2026-84430
CVE-2026-84430MEDIUM
gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes
33RIESGO
abrir ↗
Referência
CVE-2017-9730
CVE-2017-9730—
SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2026-82680
CVE-2026-82680HIGH
D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write
41RIESGO
abrir ↗
← anteriorpágina 322 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.