Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência✓ VexDay Proof
IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow
CVE-2008-3360—remotewindows
Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component Ice Gallery 0.5b2 - 'catid' Blind SQL Injection
CVE-2008-6852—webappsphp
SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to exe
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CMS NetCat 3.0/3.12 - Blind SQL Injection
CVE-2008-6853—webappsphp
SQL injection vulnerability in modules/poll/index.php in AIST NetCat 3.0 and 3.12 allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Absolute FAQ Manager 6.0 - Insecure Cookie Handling
CVE-2008-6854—webappsphp
Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative acc
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Absolute News Feed 1.0 - Remote Insecure Cookie Handling
CVE-2008-6855—webappsphp
Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain adminis
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Absolute Content Rotator 6.0 - Insecure Cookie Handling
CVE-2008-6862—webappsphp
Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting
23RIESGO
abrir ↗
Referência
CVE-2013-2586
CVE-2013-2586—
XAMPP 1.8.1 does not properly restrict access to xampp/lang.php, which allows remote attackers to modify xampp/lang.tmp
23RIESGO
abrir ↗
Referência
CVE-2014-9142
CVE-2014-9142—
Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers t
23RIESGO
abrir ↗
Referência
CVE-2009-3180
CVE-2009-3180—
Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user param
23RIESGO
abrir ↗
Referência
CVE-2014-9144
CVE-2014-9144—
Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metac
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6947—webappsphp
Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via un
23RIESGO
abrir ↗
Referência
CVE-2009-4785
CVE-2009-4785—
SQL injection vulnerability in the Quick News (com_quicknews) component for Joomla! allows remote attackers to execute a
23RIESGO
abrir ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHbajo ataque
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RIESGO
abrir ↗
Referência
CVE-2026-61517
CVE-2026-61517HIGH
Netis NX10 OS Command Injection via Ping Diagnostic Handler
41RIESGO
abrir ↗
Referência
CVE-2026-7292
CVE-2026-7292MEDIUM
o2oa NodeAgent NodeAgent.java syncFile improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-7290
CVE-2026-7290MEDIUM
JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7289
CVE-2026-7289HIGH
D-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2022-35405
CVE-2022-35405CRITICALbajo ataque
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code
100RIESGO
abrir ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHbajo ataque
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RIESGO
abrir ↗
Referência
CVE-2014-9613
CVE-2014-9613—
Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗
Referência
CVE-2026-84425
CVE-2026-84425MEDIUM
zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-61516
CVE-2026-61516CRITICAL
Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint
48RIESGO
abrir ↗
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6948—webappsphp
Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code b
23RIESGO
abrir ↗
Referência
CVE-2026-7288
CVE-2026-7288HIGH
D-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2026-7283
CVE-2026-7283MEDIUM
SourceCodester Pharmacy Sales and Inventory System ajax.php save_expired sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-27760
CVE-2026-27760CRITICAL
OpenCATS PHP Code Injection via installer AJAX endpoint
75RIESGO
abrir ↗
Referência
CVE-2026-7282
CVE-2026-7282MEDIUM
SourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7281
CVE-2026-7281MEDIUM
SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-7272
CVE-2026-7272MEDIUM
WilliamCloudQi matlab-mcp-server MCP index.ts execute_matlab_code path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7271
CVE-2026-7271MEDIUM
DV0x creative-ad-agent creative-ad-agent-server sdk-server.ts path traversal
33RIESGO
abrir ↗
← anteriorpágina 431 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.