Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2022-30190
CVE-2022-30190HIGHbajo ataqueransomware
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RIESGO
abrir ↗
Referência✓ VexDay Proof
MyForum 1.3 - Authentication Bypass
CVE-2009-1852—webappsphp
Multiple SQL injection vulnerabilities in Graphiks MyForum 1.3 allow remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Adobe JRun 4 - 'logfile' (Authenticated) Directory Traversal
CVE-2009-1873—remotewindows
Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4
23RIESGO
abrir ↗
Referência
CVE-2010-1723
CVE-2010-1723—
Directory traversal vulnerability in the iNetLanka Contact Us Draw Root Map (com_drawroot) component 1.1 for Joomla! all
38RIESGO
abrir ↗
Referência
CVE-2017-5255
CVE-2017-5255—
In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web
60RIESGO
abrir ↗
Referência✓ VexDay Proof
phpQuiz 0.1.2 - SQL Injection / Code Execution
CVE-2006-4977—webappsphp
Multiple unrestricted file upload vulnerabilities in (1) back/upload_img.php and (2) admin/upload_img.php in Walter Besc
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ZoomStats 1.0.2 - 'mysql.php' Remote File Inclusion
CVE-2006-5065—webappsphp
PHP remote file inclusion vulnerability in libs/dbmax/mysql.php in ZoomStats 1.0.2 and earlier, when register_globals is
23RIESGO
abrir ↗
Referência
CVE-2010-1944
CVE-2010-1944—
Multiple PHP remote file inclusion vulnerabilities in openMairie openCimetiere 2.01, when register_globals is enabled, a
23RIESGO
abrir ↗
Referência
CVE-2014-6278
CVE-2014-6278HIGHbajo ataque
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
100RIESGO
abrir ↗
Referência
CVE-2014-6278
CVE-2014-6278HIGHbajo ataque
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
100RIESGO
abrir ↗
Referência
CVE-2026-8121
CVE-2026-8121MEDIUM
Open5GS NSSF conv.c ogs_sbi_parse_plmn_list denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-8120
CVE-2026-8120MEDIUM
Open5GS NSSF nnssf-handler.c denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-8119
CVE-2026-8119MEDIUM
Open5GS NSSF nghttp2-server.c ogs_sbi_stream_find_by_id denial of service
33RIESGO
abrir ↗
Referência
CVE-2016-1594
CVE-2016-1594—
Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request
23RIESGO
abrir ↗
Referência
CVE-2014-6278
CVE-2014-6278HIGHbajo ataque
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
100RIESGO
abrir ↗
Referência✓ VexDay Proof
CMS-BRD - 'menuclick' SQL Injection
CVE-2008-2837—webappsphp
SQL injection vulnerability in index.php in CMS-BRD allows remote attackers to execute arbitrary SQL commands via the me
23RIESGO
abrir ↗
Referência
CVE-2017-8681
CVE-2017-8681—
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
23RIESGO
abrir ↗
Referência✓ VexDay Proof
DUcalendar 1.0 - 'iEve' SQL Injection
CVE-2008-2868—webappsasp
SQL injection vulnerability in detail.asp in DUware DUcalendar 1.0 and possibly earlier allows remote attackers to execu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
DNS Tools (PHP Digger) - Remote Command Execution
CVE-2009-1916—webappsphp
dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the
28RIESGO
abrir ↗
Referência✓ VexDay Proof
CPCommerce 1.2.x - 'GLOBALS[prefix]' Arbitrary File Inclusion
CVE-2009-1936CRITICALwebappsphp
_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called direc
60RIESGO
abrir ↗
Referência
CVE-2010-1946
CVE-2010-1946—
Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02, when register_globals is enabled,
23RIESGO
abrir ↗
Referência
CVE-2014-6278
CVE-2014-6278HIGHbajo ataque
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
100RIESGO
abrir ↗
Referência
CVE-2014-6446
CVE-2014-6446—
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows
50RIESGO
abrir ↗
Referência
CVE-2026-109620
CVE-2026-109620MEDIUM
SourceCodester Online Reviewer System index.php prepare sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
WordPress Plugin Photoracer 1.0 - 'id' SQL Injection
CVE-2009-2122—webappsphp
SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote atta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WiClear 0.10 - 'path' Remote File Inclusion
CVE-2006-5506—webappsphp
Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code
28RIESGO
abrir ↗
Referência
CVE-2026-58659
CVE-2026-58659HIGH
PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter
41RIESGO
abrir ↗
Referência
CVE-2026-15750
CVE-2026-15750MEDIUM
mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2020-14750
CVE-2020-14750CRITICALbajo ataque
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RIESGO
abrir ↗
Referência
CVE-2026-8098
CVE-2026-8098MEDIUM
code-projects Feedback System checklogin.php sql injection
33RIESGO
abrir ↗
← anteriorpágina 425 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.