Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2026-86517
CVE-2026-86517MEDIUM
itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-101013
CVE-2026-101013MEDIUM
mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2009-4220
CVE-2009-4220—
PHP remote file inclusion vulnerability in includes/classes/pctemplate.php in PointComma 3.8b2 and earlier allows remote
23RIESGO
abrir ↗
Referência✓ VexDay Proof
FdWeB Espace Membre 2.01 - 'path' Remote File Inclusion
CVE-2007-0301—webappsphp
PHP remote file inclusion vulnerability in _admin/admin_menu.php in FdWeB Espace Membre 2.1 and earlier allows remote at
23RIESGO
abrir ↗
Referência
CVE-2010-3206
CVE-2010-3206—
Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code v
23RIESGO
abrir ↗
Referência
CVE-2015-7602
CVE-2015-7602—
Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (d
50RIESGO
abrir ↗
Referência✓ VexDay Proof
Mutant 0.9.2 - 'mutant_functions.php' Remote File Inclusion
CVE-2007-1961—webappsphp
PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Expow 0.8 - 'autoindex.php?cfg_file' Remote File Inclusion
CVE-2007-2302—webappsphp
PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP c
23RIESGO
abrir ↗
Referência✓ VexDay Proof
NewsSync for phpBB 1.5.0rc6 - Remote File Inclusion
CVE-2007-3136—webappsphp
PHP remote file inclusion vulnerability in inc/nuke_include.php in newsSync 1.5.0rc6 allows remote attackers to execute
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (2)
CVE-2007-3585—webappsphp
PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
eXtremail 2.1.1 - Remote Heap Overflow (PoC)
CVE-2007-5466—doslinux
Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending
28RIESGO
abrir ↗
Referência✓ VexDay Proof
SFS EZ Gaming Cheats - SQL Injection
CVE-2008-6244—webappsphp
SQL injection vulnerability in view_reviews.php in Scripts for Sites (SFS) EZ Gaming Cheats allows remote attackers to e
23RIESGO
abrir ↗
Referência
CVE-2009-4220
CVE-2009-4220—
PHP remote file inclusion vulnerability in includes/classes/pctemplate.php in PointComma 3.8b2 and earlier allows remote
23RIESGO
abrir ↗
Referência
CVE-2009-4231
CVE-2009-4231—
Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to includ
23RIESGO
abrir ↗
Referência
CVE-2017-9516
CVE-2017-9516—
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
23RIESGO
abrir ↗
Referência
CVE-2018-17588
CVE-2018-17588—
AirTies Air 5021 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.
23RIESGO
abrir ↗
Referência
CVE-2015-1424
CVE-2015-1424—
Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentic
23RIESGO
abrir ↗
Referência
CVE-2018-9183
CVE-2018-9183—
The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.
23RIESGO
abrir ↗
Referência
CVE-2021-24444
CVE-2021-24444—
TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)
23RIESGO
abrir ↗
Referência
CVE-2009-4739
CVE-2009-4739—
PHP remote file inclusion vulnerability in index.php in SkaDate Dating allows remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗
Referência
CVE-2010-0680
CVE-2010-0680—
Directory traversal vulnerability in index.php in ZeusCMS 0.2 allows remote attackers to include and execute arbitrary l
23RIESGO
abrir ↗
Referência
CVE-2016-4337
CVE-2016-4337—
SQL injection vulnerability in the mgr.login.php file in Ktools.net Photostore before 4.7.5 allows remote attackers to e
23RIESGO
abrir ↗
Referência
CVE-2021-47728
CVE-2021-47728CRITICAL
Selea Targa IP Camera Remote Code Execution via Utils
48RIESGO
abrir ↗
Referência
CVE-2017-9516
CVE-2017-9516—
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
23RIESGO
abrir ↗
Referência
CVE-2025-34100
CVE-2025-34100CRITICAL
BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗
Referência
CVE-2025-34100
CVE-2025-34100CRITICAL
BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗
Referência
CVE-2026-86285
CVE-2026-86285MEDIUM
BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control
33RIESGO
abrir ↗
Referência
CVE-2012-5225
CVE-2012-5225—
Cross-site scripting (XSS) vulnerability in webscr.php in xClick Cart 1.0.1 and 1.0.2 allows remote attackers to inject
23RIESGO
abrir ↗
Referência✓ VexDay Proof
A-shop 0.70 - Remote File Deletion
CVE-2007-3936—webappsasp
Directory traversal vulnerability in admin/filebrowser.asp in A-shop 0.70 and earlier, and possibly 0.71, allows remote
23RIESGO
abrir ↗
Referência
CVE-2009-4099
CVE-2009-4099—
SQL injection vulnerability in the Google Calendar GCalendar (com_gcalendar) component 1.1.2, 2.1.4, and possibly earlie
23RIESGO
abrir ↗
← anteriorpágina 430 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.