Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência✓ VexDay Proof
Pro Chat Rooms 3.0.3 - SQL Injection
CVE-2008-5070—webappsphp
SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
CVE-2009-1067—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC) (1)
CVE-2009-1169—dosmultiple
The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows r
28RIESGO
abrir ↗
Referência
CVE-2014-4613
CVE-2014-4613—
Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attacke
23RIESGO
abrir ↗
Referência
CVE-2014-4663
CVE-2014-4663—
TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2015-6519
CVE-2015-6519—
SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail
23RIESGO
abrir ↗
Referência
CVE-2015-6545
CVE-2015-6545—
Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the a
23RIESGO
abrir ↗
Referência
CVE-2022-30076
CVE-2022-30076MEDIUM
ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Libxine 1.14 - MPEG Stream Buffer Overflow (PoC)
CVE-2008-1110—doslinux
Buffer overflow in demuxers/demux_asf.c (aka the ASF demuxer) in the xineplug_dmx_asf.so plugin in xine-lib before 1.1.1
28RIESGO
abrir ↗
Referência
CVE-2026-69112
CVE-2026-69112MEDIUM
Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Lansuite 2.1.0 Beta - 'fid' SQL Injection
CVE-2006-1001—webappsphp
SQL injection vulnerability in the board module in LanSuite LanParty Intranet System 2.0.6 and 2.1.0 beta allows remote
23RIESGO
abrir ↗
Referência
CVE-2026-14332
CVE-2026-14332MEDIUM
Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action
33RIESGO
abrir ↗
Referência
CVE-2026-18391
CVE-2026-18391CRITICAL
WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection
48RIESGO
abrir ↗
Referência
CVE-2026-71966
CVE-2026-71966HIGH
CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer
41RIESGO
abrir ↗
Referência
CVE-2026-19088
CVE-2026-19088MEDIUM
ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication
33RIESGO
abrir ↗
Referência
CVE-2026-73482
CVE-2026-73482HIGH
phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php
41RIESGO
abrir ↗
Referência
CVE-2024-58374
CVE-2024-58374HIGH
Hongjing e-HR Unauthenticated SQL Injection via getSdutyTree
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Apple Mac OSX xnu 1228.x - 'vfssysctl' Local Kernel Denial of Service (PoC)
CVE-2009-1238—dososx
Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows
23RIESGO
abrir ↗
Referência
CVE-2026-18366
CVE-2026-18366CRITICAL
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
48RIESGO
abrir ↗
Referência
CVE-2026-18945
CVE-2026-18945HIGH
WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation
41RIESGO
abrir ↗
Referência
CVE-2026-14213
CVE-2026-14213LOW
Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR
28RIESGO
abrir ↗
Referência
CVE-2026-18230
CVE-2026-18230HIGH
WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-71965
CVE-2026-71965HIGH
CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature
41RIESGO
abrir ↗
Referência
CVE-2026-71964
CVE-2026-71964HIGH
CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload
41RIESGO
abrir ↗
Referência
CVE-2026-71962
CVE-2026-71962HIGH
Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download
41RIESGO
abrir ↗
Referência
CVE-2014-9101
CVE-2014-9101—
Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (b
23RIESGO
abrir ↗
Referência✓ VexDay Proof
pSys 0.7.0.a - 'shownews' SQL Injection
CVE-2008-5269—webappsphp
SQL injection vulnerability in index.php in pSys 0.7.0 alpha allows remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗
Referência✓ VexDay Proof
FlexCMS Calendar - 'itemID' Blind SQL Injection
CVE-2009-1256—webappsphp
SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId para
23RIESGO
abrir ↗
Referência
CVE-2016-5845
CVE-2016-5845—
SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to ca
23RIESGO
abrir ↗
Referência
CVE-2014-9113
CVE-2014-9113—
CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Use
23RIESGO
abrir ↗
← anteriorpágina 401 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.