Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2026-112093
subhajitkhan online-clinic-management-system feedback.php cross site scripting
33RIESGO
abrir ↗Referência
CVE-2022-44877
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execut
100RIESGO
abrir ↗Referência✓ VexDay Proof
XnView 1.93.6 - '.taac' Local Buffer Overflow
Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD a
28RIESGO
abrir ↗Referência✓ VexDay Proof
DELTAScripts PHP Classifieds 7.5 - SQL Injection
SQL injection vulnerability in detail.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to exe
23RIESGO
abrir ↗Referência✓ VexDay Proof
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RIESGO
abrir ↗Referência
CVE-2017-17596
Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.
23RIESGO
abrir ↗Referência
CVE-2026-103376
PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check
33RIESGO
abrir ↗Referência✓ VexDay Proof
WMNews 0.2a - 'base_datapath' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in WMNews 0.2a and earlier allows remote attackers to execute arbit
23RIESGO
abrir ↗Referência
CVE-2022-47870
A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows r
33RIESGO
abrir ↗Referência
CVE-2026-112020
LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()
33RIESGO
abrir ↗Referência✓ VexDay Proof
Kayako eSupport 2.3.1 - 'subd' Remote File Inclusion
PHP remote file inclusion vulnerability in esupport/admin/autoclose.php in Kayako eSupport 2.3.1 and earlier, when regis
23RIESGO
abrir ↗Referência
CVE-2026-95182
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supply
48RIESGO
abrir ↗Referência
CVE-2026-111284
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
33RIESGO
abrir ↗Referência
CVE-2026-111993
Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage
33RIESGO
abrir ↗Referência
CVE-2026-111992
itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection
33RIESGO
abrir ↗Referência✓ VexDay Proof
NEWSolved Lite 1.9.2 - 'abs_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in USOLVED NEWSolved Lite 1.9.2, and possibly earlier, allow remote a
28RIESGO
abrir ↗Referência✓ VexDay Proof
Microsoft Works 7 - 'WkImgSrv.dll' ActiveX Remote Buffer Overflow
A certain ActiveX control in WkImgSrv.dll 7.03.0616.0, as distributed in Microsoft Works 7 and Microsoft Office 2003 and
50RIESGO
abrir ↗Referência
CVE-2012-2572
Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote a
23RIESGO
abrir ↗Referência✓ VexDay Proof
LaserNet CMS 1.5 - SQL Injection
SQL injection vulnerability in index.php in Lasernet CMS 1.5 and 1.11, when magic_quotes_gpc is disabled, allows remote
23RIESGO
abrir ↗Referência✓ VexDay Proof
C6 Messenger - ActiveX Remote Download and Execute
The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force
50RIESGO
abrir ↗Referência✓ VexDay Proof
Java SE Runtime Environment JRE 6 Update 13 - Multiple Vulnerabilities
The Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 1
23RIESGO
abrir ↗Referência✓ VexDay Proof
32bit FTP - 'PASV' Reply Client Remote Overflow (Metasploit)
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
43RIESGO
abrir ↗Referência✓ VexDay Proof
Joomla! Component com_gsticketsystem - 'catid' Blind SQL Injection
SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remo
23RIESGO
abrir ↗Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject
23RIESGO
abrir ↗Referência✓ VexDay Proof
Realty Web-Base 1.0 - 'list_list.php?id' SQL Injection
SQL injection vulnerability in list_list.php in Realty Webware Technologies Web-Base 1.0 allows remote attackers to exec
23RIESGO
abrir ↗Referência
CVE-2017-17603
Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_
23RIESGO
abrir ↗Referência
CVE-2017-17605
Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.