Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência✓ VexDay Proof
The Net Guys ASPired2Protect - Database Disclosure
CVE-2008-6355—webappsasp
The Net Guys ASPired2Protect stores sensitive information under the web root with insufficient access control, which all
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component live chat - SQL Injection / Open Proxy
CVE-2008-6882—webappsphp
Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PAD Site Scripts 3.6 - Arbitrary Database Backup
CVE-2009-1941—webappsphp
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which al
23RIESGO
abrir ↗
Referência✓ VexDay Proof
VT-Auth 1.0 - 'zHk8dEes3.txt' File Disclosure
CVE-2009-2024—webappsasp
Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control, which a
23RIESGO
abrir ↗
Referência
CVE-2011-5108
CVE-2011-5108—
Cross-site scripting (XSS) vulnerability in config.php in AdaptCMS 2.0.0 and 2.0.1 allows remote attackers to inject arb
23RIESGO
abrir ↗
Referência
CVE-2015-4684
CVE-2015-4684—
Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) re
23RIESGO
abrir ↗
Referência
CVE-2012-1021
CVE-2012-1021—
Cross-site scripting (XSS) vulnerability in admin/categories.php in 4images 1.7.10 allows remote attackers to inject arb
23RIESGO
abrir ↗
Referência
CVE-2009-3756
CVE-2009-3756—
phpBMS 0.96 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php, (2) header.p
23RIESGO
abrir ↗
Referência
CVE-2010-1307
CVE-2010-1307—
Directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers
43RIESGO
abrir ↗
Referência
CVE-2010-1313
CVE-2010-1313—
Directory traversal vulnerability in the Seber Cart (com_sebercart) component 1.0.0.12 and 1.0.0.13 for Joomla!, when ma
38RIESGO
abrir ↗
Referência
CVE-2018-13032
CVE-2018-13032—
ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/pl_web.cgi/util_configlogi
23RIESGO
abrir ↗
Referência
CVE-2014-4716
CVE-2014-4716—
Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authenticatio
23RIESGO
abrir ↗
Referência
CVE-2012-10019
CVE-2012-10019CRITICAL
Front-end Editor < 2.3 - Arbitrary File Upload
63RIESGO
abrir ↗
Referência
Veeam ONE Reporter 9.5.0.3201 - Multiple Cross-Site Request Forgery
CVE-2019-11569—webappsashx
Veeam ONE Reporter 9.5.0.3201 allows CSRF.
23RIESGO
abrir ↗
Referência
CVE-2016-6255
CVE-2016-6255—
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a P
28RIESGO
abrir ↗
Referência
CVE-2013-6341
CVE-2013-6341—
SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência
CVE-2015-7898
CVE-2015-7898—
Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).
23RIESGO
abrir ↗
Referência
CVE-2026-2686
CVE-2026-2686CRITICAL
SECCN Dingcheng G10 session_login.cgi qq os command injection
48RIESGO
abrir ↗
Referência✓ VexDay Proof
R2K Gallery 1.7 - 'galeria.php?lang2' Local File Inclusion
CVE-2007-2642—webappsphp
Directory traversal vulnerability in galeria.php in R2K Gallery 1.7 allows remote attackers to read arbitrary files via
23RIESGO
abrir ↗
Referência
CVE-2012-5099
CVE-2012-5099—
Cross-site scripting (XSS) vulnerability in list.php in PHPB2B 4.1 and earlier allows remote attackers to inject arbitra
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Pritlog 0.4 - 'Filename' Remote File Disclosure
CVE-2008-6012—webappsphp
Directory traversal vulnerability in index.php in Pritlog 0.4 and earlier, when magic_quotes_gpc is disabled, allows rem
23RIESGO
abrir ↗
Referência
CVE-2026-85138
CVE-2026-85138MEDIUM
SeaCMS WeChat index.php addslashes sql injection
33RIESGO
abrir ↗
Referência
CVE-2008-6385
CVE-2008-6385—
Cross-site scripting (XSS) vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to inject arbitra
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Studio Lounge Address Book 2.5 - 'profile' Arbitrary File Upload
CVE-2009-1483—webappsphp
Unrestricted file upload vulnerability in upload-file.php in Adam Patterson Studio Lounge Address Book 2.5, as reachable
23RIESGO
abrir ↗
Referência
CVE-2013-6341
CVE-2013-6341—
SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência
CVE-2009-4548
CVE-2009-4548—
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web
23RIESGO
abrir ↗
Referência
CVE-2018-15596
CVE-2018-15596—
An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can gener
23RIESGO
abrir ↗
Referência
CVE-2023-42627
CVE-2023-42627CRITICAL
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.
48RIESGO
abrir ↗
Referência
CVE-2018-6190
CVE-2018-6190—
Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page.
23RIESGO
abrir ↗
Referência
CVE-2009-2587
CVE-2009-2587—
Multiple cross-site scripting (XSS) vulnerabilities in DragDropCart allow remote attackers to inject arbitrary web scrip
23RIESGO
abrir ↗
← anteriorpágina 407 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.