Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados

40.452CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

26.240 exploits

Referência

CVE-2016-2388

CVE-2016-2388MEDIUMbajo ataque

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor

75RIESGO

abrir ↗

Referência

CVE-2023-29809

CVE-2023-29809CRITICAL

SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbit

53RIESGO

abrir ↗

Referência✓ VexDay Proof

Cmaps v8.0 - SQL injection

CVE-2023-29809CRITICALwebappsphp

SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbit

53RIESGO

abrir ↗

Referência

CVE-2026-94540

CVE-2026-94540HIGH

DesktopSMS 1.11.0 Unauthorized Access via Local Service

41RIESGO

abrir ↗

Referência✓ VexDay Proof

impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting

CVE-2009-2154—webappsphp

SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows

23RIESGO

abrir ↗

Referência✓ VexDay Proof

OCS Inventory NG 1.02 - Remote File Disclosure

CVE-2009-2166—webappsphp

Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to re

23RIESGO

abrir ↗

Referência

CVE-2014-6593

CVE-2014-6593—

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.

50RIESGO

abrir ↗

Referência

CVE-2016-1105

CVE-2016-1105—

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof

35RIESGO

abrir ↗

Referência

CVE-2026-14210

CVE-2026-14210MEDIUM

Insufficient Granularity of Access Control in GitLab

33RIESGO

abrir ↗

Referência

CVE-2010-0802

CVE-2010-0802—

SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote a

23RIESGO

abrir ↗

Referência

CVE-2016-4534

CVE-2016-4534—

The McAfee VirusScan Console (mcconsol.exe) in McAfee VirusScan Enterprise 8.8.0 before Hotfix 1123565 (8.8.0.1546) on W

23RIESGO

abrir ↗

Referência

CVE-2023-3187

CVE-2023-3187MEDIUM

PHPGurukul Teachers Record Management System Profile Picture changeimage.php unrestricted upload

33RIESGO

abrir ↗

Referência✓ VexDay Proof

Essentia Web Server 2.15 - GET Remote Denial of Service

CVE-2006-5850—doswindows

Stack-based buffer overflow in Essentia Web Server 2.15 for Windows allows remote attackers to execute arbitrary code vi

23RIESGO

abrir ↗

Referência

CVE-2008-6392

CVE-2008-6392—

SQL injection vulnerability in showads.php in Z1Exchange allows remote attackers to execute arbitrary SQL commands via t

23RIESGO

abrir ↗

Referência

CVE-2023-33592

CVE-2023-33592—

Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lf

23RIESGO

abrir ↗

Referência

CVE-2009-2255

CVE-2009-2255—

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which a

35RIESGO

abrir ↗

Referência

CVE-2009-2257

CVE-2009-2257—

The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to bypass authentic

23RIESGO

abrir ↗

Referência

CVE-2026-109176

CVE-2026-109176MEDIUM

MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

33RIESGO

abrir ↗

Referência

CVE-2021-40539

CVE-2021-40539CRITICALbajo ataqueransomware

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta

100RIESGO

abrir ↗

Referência

CVE-2019-3929

CVE-2019-3929CRITICALbajo ataque

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba

100RIESGO

abrir ↗

Referência

CVE-2026-19934

CVE-2026-19934MEDIUM

itsourcecode Hospital Management System vieworder.php sql injection

33RIESGO

abrir ↗

Referência

CVE-2019-25676

CVE-2019-25676HIGH

Ask Expert Script 3.0.5 Cross Site Scripting SQL Injection

41RIESGO

abrir ↗

Referência

CVE-2017-8489

CVE-2017-8489—

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,

23RIESGO

abrir ↗

Referência✓ VexDay Proof

DoSePa 1.0.4 - 'textview.php' Information Disclosure

CVE-2006-6028—webappsphp

Directory traversal vulnerability in textview.php in Anton Vlasov DoSePa 1.0.4 allows remote attackers to read arbitrary

23RIESGO

abrir ↗

Referência

CVE-2009-2441

CVE-2009-2441—

Cross-site scripting (XSS) vulnerability in ogp_show.php in Online Guestbook Pro 5.1 allows remote attackers to inject a

23RIESGO

abrir ↗

Referência

CVE-2017-8537

CVE-2017-8537—

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serve

28RIESGO

abrir ↗

Referência

CVE-2009-2477

CVE-2009-2477—

js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1

50RIESGO

abrir ↗

Referência

CVE-2009-4697

CVE-2009-4697—

Multiple cross-site scripting (XSS) vulnerabilities in index.php in RadNICS Gold 5 allow remote attackers to inject arbi

23RIESGO

abrir ↗

Referência

CVE-2017-9791

CVE-2017-9791CRITICALbajo ataque

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passe

100RIESGO

abrir ↗

Referência

CVE-2026-14736

CVE-2026-14736MEDIUM

Ruijie RG-UAC user_auth_commit.php unrestricted upload

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.