Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2012-1900
CVE-2012-1900—
Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2025-15662
CVE-2025-15662HIGH
Printcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery
41RIESGO
abrir ↗
Referência
CVE-2026-67185
CVE-2026-67185HIGH
TinyWeb 0.0.8 Path Traversal via URL Path Component
41RIESGO
abrir ↗
Referência✓ VexDay Proof
skyportal vrc6 - Multiple Vulnerabilities
CVE-2007-6078—webappsphp
Multiple SQL injection vulnerabilities in SkyPortal RC6 allow remote attackers to execute arbitrary SQL commands via uns
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Sciurus Hosting Panel - Remote Code Injection
CVE-2007-6082—webappsphp
Direct static code injection vulnerability in acp/savenews.php in Sciurus Hosting Panel, possibly 2.0.3, allows remote a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Venalsur on-line Booking Centre - Cross-Site Scripting / SQL Injection
CVE-2008-6215—webappsphp
Cross-site scripting (XSS) vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels
23RIESGO
abrir ↗
Referência✓ VexDay Proof
wotw 5.0 - Local/Remote File Inclusion
CVE-2008-6224—webappsphp
Directory traversal vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2009-4583
CVE-2009-4583—
SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2014-4138
CVE-2014-4138—
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory co
35RIESGO
abrir ↗
Referência
CVE-2014-3878
CVE-2014-3878—
Multiple cross-site scripting (XSS) vulnerabilities in the web client interface in Ipswitch IMail Server 12.3 and 12.4,
23RIESGO
abrir ↗
Referência✓ VexDay Proof
E-topbiz ADManager 4 - 'group' Blind SQL Injection
CVE-2008-6261—webappsphp
SQL injection vulnerability in view.php in E-topbiz AdManager 4 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2026-86295
CVE-2026-86295MEDIUM
D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection
33RIESGO
abrir ↗
Referência
CVE-2026-79615
CVE-2026-79615LOW
Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR
28RIESGO
abrir ↗
Referência
CVE-2026-86291
CVE-2026-86291MEDIUM
itsourcecode Sales and Inventory System us_edit1.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-19423
CVE-2026-19423HIGH
Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms
41RIESGO
abrir ↗
Referência
CVE-2026-19084
CVE-2026-19084HIGH
Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read
41RIESGO
abrir ↗
Referência
CVE-2026-86290
CVE-2026-86290MEDIUM
SourceCodester Online Voting System ajax.php save_category sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
SaturnCMS - Blind SQL Injection
CVE-2008-6263—webappsphp
SQL injection vulnerability in lib/user/t_user.php in SaturnCMS allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2014-5275
CVE-2014-5275—
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote au
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Cyberfolio 7.12.2 - 'theme' Local File Inclusion
CVE-2008-6265—webappsphp
Directory traversal vulnerability in portfolio/css.php in Cyberfolio 7.12.2 and earlier allows remote attackers to inclu
23RIESGO
abrir ↗
Referência
CVE-2014-5094
CVE-2014-5094—
Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.p
23RIESGO
abrir ↗
Referência✓ VexDay Proof
cf shopkart 5.2.2 - SQL Injection / File Disclosure
CVE-2008-6321—webappsasp
CF Shopkart 5.2.2 stores cfshopkart52.mdb under the web root with insufficient access control, which allows remote attac
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CFMBLOG - 'categorynbr' Blind SQL Injection
CVE-2008-6322—webappsasp
SQL injection vulnerability in index.cfm in CFMSource CFMBlog allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2022-22954
CVE-2022-22954CRITICALbajo ataqueransomware
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
100RIESGO
abrir ↗
Referência
CVE-2018-11776
CVE-2018-11776HIGHbajo ataque
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗
Referência
CVE-2026-19899
CVE-2026-19899MEDIUM
SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2018-7600
CVE-2018-7600CRITICALbajo ataqueransomware
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RIESGO
abrir ↗
Referência
CVE-2026-19827
CVE-2026-19827MEDIUM
alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-19895
CVE-2026-19895MEDIUM
opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication
33RIESGO
abrir ↗
Referência
CVE-2018-7600
CVE-2018-7600CRITICALbajo ataqueransomware
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RIESGO
abrir ↗
← anteriorpágina 427 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.