Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
77.231exploits catalogados
35.420CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.451Referência 22.266GitHub PoC 14.131VulnCheck XDB 8635Nuclei 4274Metasploit 3474✓ solo verificadosrecientespopularesriesgo
22.266 exploits
Referência
CVE-2026-7859
Motors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media
33RIESGO
abrir ↗Referência✓ VexDay Proof
CMS Frogss 0.4 - 'podpis' SQL Injection
SQL injection vulnerability in module/rejestracja.php in CMS Frogss 0.4 and earlier allows remote attackers to execute a
23RIESGO
abrir ↗Referência✓ VexDay Proof
TR Forum 2.0 - SQL Injection / Bypass Security Restriction
The admin panel in Tr Forum 2.0 accepts a username and password hash for authentication, which allows remote authenticat
23RIESGO
abrir ↗Referência✓ VexDay Proof
Yourownbux 4.0 - 'cookie' SQL Injection
SQL injection vulnerability in referrals.php in YourOwnBux 4.0 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗Referência
CVE-2017-16356
Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScrip
23RIESGO
abrir ↗Referência✓ VexDay Proof
Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload
Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Editio
28RIESGO
abrir ↗Referência✓ VexDay Proof
TorrentTrader Classic 1.04 - Blind SQL Injection
SQL injection vulnerability in completed-advance.php in TorrentTrader Classic 1.08 and 1.04 and earlier allows remote at
23RIESGO
abrir ↗Referência✓ VexDay Proof
Built2Go PHP Realestate 1.5 - 'event_detail.php' SQL Injection
SQL injection vulnerability in event_detail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute
23RIESGO
abrir ↗Referência✓ VexDay Proof
TikiWiki 1.9 Sirius - 'jhot.php' Remote Command Execution
Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execu
50RIESGO
abrir ↗Referência✓ VexDay Proof
PHP Autos 2.9.1 - 'catid' SQL Injection
SQL injection vulnerability in searchresults.php in PHP Autos 2.9.1 allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗Referência
CVE-2026-9442
Edimax BR-6478AC POST Request formiNICSiteSurvey buffer overflow
41RIESGO
abrir ↗Referência
CVE-2017-16836
Arris TG1682G devices with Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via
23RIESGO
abrir ↗Referência
CVE-2017-17098
The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote a
23RIESGO
abrir ↗Referência✓ VexDay Proof
Joomla! Component actualite 1.0 - 'id' SQL Injection
SQL injection vulnerability in the actualite module 1.0 for Joomla! allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗Referência✓ VexDay Proof
Meeting Room Booking System (MRBS) < 1.4 - SQL Injection
SQL injection vulnerability in Meeting Room Booking System (MRBS) before 1.4 allows remote attackers to execute arbitrar
23RIESGO
abrir ↗Referência✓ VexDay Proof
Joomla! Component ds-syndicate - 'feed_id' SQL Injection
SQL injection vulnerability in the DS-Syndicate (com_ds-syndicate) component 1.1.1 for Joomla allows remote attackers to
23RIESGO
abrir ↗Referência
CVE-2010-3267
Multiple SQL injection vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to execute arbitr
23RIESGO
abrir ↗Referência✓ VexDay Proof
Fast Click SQL 1.1.7 Lite - 'init.php' Remote File Inclusion
PHP remote file inclusion vulnerability in init.php in Fast Click SQL Lite 1.1.7, when register_globals is enabled, allo
23RIESGO
abrir ↗Referência✓ VexDay Proof
WordPress Plugin st_newsletter - 'stnl_iframe.php' SQL Injection
SQL injection vulnerability in stnl_iframe.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows r
23RIESGO
abrir ↗Referência
CVE-2010-4970
SQL injection vulnerability in handlers/getpage.php in Wiki Web Help 0.28 allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗Referência
CVE-2010-3275
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a
60RIESGO
abrir ↗Referência
CVE-2017-17562
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RIESGO
abrir ↗Referência
CVE-2026-48558
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
53RIESGO
abrir ↗Referência✓ VexDay Proof
XOOPS Module makale 0.26 - SQL Injection
SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote
23RIESGO
abrir ↗Referência
CVE-2026-7713
crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization
33RIESGO
abrir ↗Referência
CVE-2017-17580
FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.
23RIESGO
abrir ↗Referência
CVE-2017-17580
FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.
23RIESGO
abrir ↗Referência✓ VexDay Proof
Hummingbird Deployment Wizard 2008 - ActiveX Command Execution
Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in
35RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.