Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência✓ VexDay Proof
S9Y Serendipity 1.0.3 - 'comment.php' Local File Inclusion
CVE-2006-6242—webappsphp
Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include
23RIESGO
abrir ↗
Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2982—webappsphp
Multiple directory traversal vulnerabilities in HomePH Design 2.10 RC2, when register_globals is enabled, allow remote a
23RIESGO
abrir ↗
Referência
CVE-2012-3152
CVE-2012-3152CRITICALbajo ataque
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Bea Weblogic Apache Connector - Code Execution / Denial of Service
CVE-2008-3257—remotewindows
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10
60RIESGO
abrir ↗
Referência✓ VexDay Proof
Miniweb 2.0 - Authentication Bypass
CVE-2008-6582—webappsphp
SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via th
23RIESGO
abrir ↗
Referência✓ VexDay Proof
2WIRE DSL Router - 'xslt' Denial of Service
CVE-2008-6605—doshardware
Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 17
23RIESGO
abrir ↗
Referência
CVE-2016-1287
CVE-2016-1287—
Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0
45RIESGO
abrir ↗
Referência✓ VexDay Proof
Ultimate HelpDesk - Cross-Site Scripting / Local File Disclosure
CVE-2006-6380—webappsasp
Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary w
23RIESGO
abrir ↗
Referência
CVE-2010-4830
CVE-2010-4830—
SQL injection vulnerability in Resumes/TD_RESUME_Indlist.asp in Techno Dreams (T-Dreams) Job Career Package 3.0 allows r
23RIESGO
abrir ↗
Referência
CVE-2014-9415
CVE-2014-9415—
Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted QE
23RIESGO
abrir ↗
Referência
CVE-2016-5847
CVE-2016-5847—
SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard l
23RIESGO
abrir ↗
Referência
CVE-2026-108879
CVE-2026-108879MEDIUM
JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-82925
CVE-2026-82925HIGH
Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature
41RIESGO
abrir ↗
Referência
CVE-2021-39144
CVE-2021-39144HIGHbajo ataque
XStream is vulnerable to a Remote Command Execution attack
100RIESGO
abrir ↗
Referência
CVE-2014-9416
CVE-2014-9416—
Multiple untrusted search path vulnerabilities in Huawei eSpace Desktop before V200R003C00 allow local users to execute
23RIESGO
abrir ↗
Referência
CVE-2017-9248
CVE-2017-9248CRITICALbajo ataque
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
100RIESGO
abrir ↗
Referência✓ VexDay Proof
BlazeVideo HDTV Player 2.1 - '.PLF' Local Buffer Overflow
CVE-2006-6396—localwindows
Stack-based buffer overflow in BlazeVideo HDTV Player 2.1, and possibly earlier, allows remote attackers to execute arbi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
J-OWAMP Web Interface 2.1b - 'link' Remote File Inclusion
CVE-2006-6453—webappsphp
PHP remote file inclusion vulnerability in JOWAMP_ShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Fantastic News 2.1.4 - 'news.php' SQL Injection
CVE-2006-6542—webappsphp
SQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2016-6434
CVE-2016-6434—
Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive
23RIESGO
abrir ↗
Referência
CVE-2026-12809
CVE-2026-12809MEDIUM
Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection
33RIESGO
abrir ↗
Referência
CVE-2023-28285
CVE-2023-28285HIGH
Microsoft Office Remote Code Execution Vulnerability
41RIESGO
abrir ↗
Referência
CVE-2026-12770
CVE-2026-12770MEDIUM
BerriAI litellm Admin Key key_management_endpoints.py improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-87928
CVE-2026-87928MEDIUM
MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Sambar FTP Server 6.4 - 'SIZE' Remote Denial of Service
CVE-2006-6624—doswindows
The FTP Server in Sambar Server 6.4 allows remote authenticated users to cause a denial of service (application crash) v
23RIESGO
abrir ↗
Referência
CVE-2015-2366
CVE-2015-2366—
win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Wi
23RIESGO
abrir ↗
Referência
CVE-2026-9710
CVE-2026-9710HIGH
Themeco Cornerstone < 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash Disclosure
41RIESGO
abrir ↗
Referência
CVE-2026-83537
CVE-2026-83537MEDIUM
WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment
33RIESGO
abrir ↗
Referência
CVE-2024-0204
CVE-2024-0204CRITICAL
Authentication Bypass in GoAnywhere MFT
85RIESGO
abrir ↗
Referência
CVE-2024-0723
CVE-2024-0723MEDIUM
freeSSHd denial of service
33RIESGO
abrir ↗
← anteriorpágina 375 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.