Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.853exploits catalogados

39.383CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

25.447 exploits

Referência✓ VexDay Proof

E-topbiz Link Back Checker 1 - Insecure Cookie Handling

CVE-2008-6307—webappsphp

E-topbiz Link Back Checker 1 allows remote attackers to bypass authentication and gain administrative access by setting

23RIESGO

abrir ↗

Referência

CVE-2025-61884

CVE-2025-61884HIGHbajo ataqueransomware

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions

100RIESGO

abrir ↗

Referência

CVE-2026-18216

CVE-2026-18216MEDIUM

Backup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login

33RIESGO

abrir ↗

Referência✓ VexDay Proof

cf shopkart 5.2.2 - SQL Injection / File Disclosure

CVE-2008-6321—webappsasp

CF Shopkart 5.2.2 stores cfshopkart52.mdb under the web root with insufficient access control, which allows remote attac

23RIESGO

abrir ↗

Referência✓ VexDay Proof

AJ Classifieds 1.0 - 'postingdetails.php' SQL Injection

CVE-2007-1296—webappsphp

SQL injection vulnerability in postingdetails.php in AJ Classifieds 1.0 allows remote attackers to execute arbitrary SQL

23RIESGO

abrir ↗

Referência✓ VexDay Proof

k-links directory - SQL Injection / Cross-Site Scripting

CVE-2008-3580—webappsphp

Multiple SQL injection vulnerabilities in Qsoft K-Links allow remote attackers to execute arbitrary SQL commands via (1)

23RIESGO

abrir ↗

Referência

CVE-2010-4797

CVE-2010-4797—

Multiple SQL injection vulnerabilities in the log-in form in Truworth Flex Timesheet allow remote attackers to execute a

23RIESGO

abrir ↗

Referência

CVE-2019-18818

CVE-2019-18818—

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

60RIESGO

abrir ↗

Referência✓ VexDay Proof

XNova 0.8 sp1 - 'xnova_root_path' Remote File Inclusion

CVE-2008-6023—webappsphp

PHP remote file inclusion vulnerability in includes/todofleetcontrol.php in a newer version of Xnova, possibly 0.8 sp1,

23RIESGO

abrir ↗

Referência✓ VexDay Proof

CF_Auction - Blind SQL Injection

CVE-2008-6323—webappsasp

SQL injection vulnerability in forummessages.cfm in CFMSource CF_Auction allows remote attackers to execute arbitrary SQ

23RIESGO

abrir ↗

Referência★ 47

Unauthenticated RCE on CraftCMS when PHP `register_argc_argv` config setting is enabled

CVE-2024-56145CRITICALbajo ataque

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

100RIESGO

abrir ↗

Referência✓ VexDay Proof

Text Lines Rearrange Script - 'Filename' File Disclosure

CVE-2008-6336—webappsphp

Directory traversal vulnerability in download.php in Text Lines Rearrange Script 1.0, when register_globals is enabled,

23RIESGO

abrir ↗

Referência✓ VexDay Proof

ASP-CMS 1.0 - 'cha' SQL Injection

CVE-2008-6353—webappsasp

SQL injection vulnerability in index.asp in ASP-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via th

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Simple Forum 3.2 - File Disclosure / Cross-Site Scripting

CVE-2008-0542—webappsphp

Directory traversal vulnerability in thumbnail.php in Gerd Tentler Simple Forum 3.2 allows remote attackers to read arbi

23RIESGO

abrir ↗

Referência✓ VexDay Proof

The Net Guys ASPired2Poll - Remote Database Disclosure

CVE-2008-6354—webappsasp

The Net Guys ASPired2poll stores sensitive information under the web root with insufficient access control, which allows

23RIESGO

abrir ↗

Referência

CVE-2010-0721

CVE-2010-0721—

SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL comman

23RIESGO

abrir ↗

Referência

CVE-2026-19834

CVE-2026-19834MEDIUM

Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization

33RIESGO

abrir ↗

Referência

CVE-2003-20001

CVE-2003-20001MEDIUM

An issue was discovered on Mitel ICP VoIP 3100 devices. When a remote user attempts to log in via TELNET during the logi

33RIESGO

abrir ↗

Referência

CVE-2010-4829

CVE-2010-4829—

SQL injection vulnerability in processview.asp in Techno Dreams (T-Dreams) Cars Ads Package 2.0 allows remote attackers

23RIESGO

abrir ↗

Referência✓ VexDay Proof

WEBO (Web ORGanizer) 1.0 - 'baseDir' Remote File Inclusion

CVE-2007-1391—webappsphp

PHP remote file inclusion vulnerability in modules/abook/foldertree.php in Leo West WEBO (aka weborganizer) 1.0 allows r

23RIESGO

abrir ↗

Referência

CVE-2010-4838

CVE-2010-4838—

SQL injection vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote authenticated users

23RIESGO

abrir ↗

Referência✓ VexDay Proof

PMB Services 3.0.13 - Multiple Remote File Inclusions

CVE-2007-1415—webappsphp

Multiple PHP remote file inclusion vulnerabilities in PMB Services 3.0.13 and earlier allow remote attackers to execute

23RIESGO

abrir ↗

Referência✓ VexDay Proof

IntelliTamper 2.07 - 'imgsrc' Remote Buffer Overflow

CVE-2008-3583—remotewindows

Buffer overflow in the HTML parser in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a long UR

23RIESGO

abrir ↗

Referência✓ VexDay Proof

PHP iCalendar 2.24 - 'cookie_language' Local File Inclusion / Arbitrary File Upload

CVE-2008-5968—webappsphp

Directory traversal vulnerability in print.php in PHP iCalendar 2.24 and earlier allows remote attackers to include and

23RIESGO

abrir ↗

Referência

CVE-2008-5970

CVE-2008-5970—

SQL injection vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated users to exe

23RIESGO

abrir ↗

Referência

CVE-2021-3378

CVE-2021-3378—

FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUpl

60RIESGO

abrir ↗

Referência

CVE-2023-22855

CVE-2023-22855CRITICAL

Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 808

53RIESGO

abrir ↗

Referência✓ VexDay Proof

Ad Management Java - Authentication Bypass

CVE-2008-6365—webappsasp

SQL injection vulnerability in logon.jsp in Ad Server Solutions Ad Management Software Java allows remote attackers to e

23RIESGO

abrir ↗

Referência

CVE-2008-6386

CVE-2008-6386—

Cross-site scripting (XSS) vulnerability in showads.php in Z1Exchange 1.0 allows remote attackers to inject arbitrary we

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Sofi WebGui 0.6.3 PRE - 'mod_dir' Remote File Inclusion

CVE-2008-6402—webappsphp

PHP remote file inclusion vulnerability in hu/modules/reg-new/modstart.php in Sofi WebGui 0.6.3 PRE and earlier allows r

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.