Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência✓ VexDay Proof
Softbiz Auctions Script - 'product_desc.php' SQL Injection
CVE-2007-5999—webappsphp
SQL injection vulnerability in product_desc.php in Softbiz Auctions Script allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
freeSSHd 1.2.1 - (Authenticated) SFTP 'rename' Remote Buffer Overflow (PoC)
CVE-2008-4762—doswindows
Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service cr
28RIESGO
abrir ↗
Referência
CVE-2010-4860
CVE-2010-4860—
SQL injection vulnerability in product_desc.php in MyPhpAuction 2010 allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Seditio CMS Events Plugin - 'c' SQL Injection
CVE-2009-1411—webappsphp
SQL injection vulnerability in events/inc/events.inc.php in the Events plugin for Seditio CMS 1.0 allows remote attacker
23RIESGO
abrir ↗
Referência
CVE-2010-4911
CVE-2010-4911—
SQL injection vulnerability in classi/detail.php in PHP Classifieds Ads allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2026-34110
CVE-2026-34110CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php
48RIESGO
abrir ↗
Referência
CVE-2026-14440
CVE-2026-14440HIGH
Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records
41RIESGO
abrir ↗
Referência
CVE-2026-59098
CVE-2026-59098HIGH
LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search
41RIESGO
abrir ↗
Referência
CVE-2022-29464
CVE-2022-29464CRITICALbajo ataqueransomware
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RIESGO
abrir ↗
Referência
CVE-2010-4954
CVE-2010-4954—
SQL injection vulnerability in product_reviews_info.php in xt:Commerce Gambio 2008 allows remote attackers to execute ar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
1024 CMS 0.7 - 'download.php' Remote File Disclosure
CVE-2007-2507—webappsphp
Directory traversal vulnerability in includes/download.php in Treble Designs 1024 CMS 0.7 allows remote attackers to rea
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Maran PHP Shop - 'prod.php' SQL Injection
CVE-2008-4879—webappsphp
SQL injection vulnerability in prod.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Maran PHP Shop - 'prodshow.php' SQL Injection
CVE-2008-4880—webappsphp
SQL injection vulnerability in prodshow.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência✓ VexDay Proof
YourFreeWorld Classifieds Hosting - SQL Injection
CVE-2008-4884—webappsphp
SQL injection vulnerability in tr.php in YourFreeWorld Classifieds Hosting Script allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência
CVE-2026-86667
CVE-2026-86667MEDIUM
aircheng-org iWebShop-5 member.php member_list sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-57517
CVE-2026-57517CRITICAL
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
48RIESGO
abrir ↗
Referência
CVE-2026-90683
CVE-2026-90683MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_unregister assertion
33RIESGO
abrir ↗
Referência
CVE-2026-86808
CVE-2026-86808MEDIUM
moltis-org moltis vault.rs vault_recovery_handler missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-86672
CVE-2026-86672MEDIUM
ningzichun Student Management System Backup example.7z information disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-86669
CVE-2026-86669MEDIUM
aircheng-org iWebShop-5 systemseller.php login improper authentication
33RIESGO
abrir ↗
Referência
CVE-2026-86668
CVE-2026-86668MEDIUM
aircheng-org iWebShop-5 pic.php uploadFile cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Visagesoft eXPert PDF ViewerX - 'VSPDFViewerX.ocx' File Overwrite
CVE-2008-4919—remotewindows
Insecure method vulnerability in VISAGESOFT eXPert PDF Viewer X ActiveX control (VSPDFViewerX.ocx) 3.0.990.0 allows remo
23RIESGO
abrir ↗
Referência
CVE-2026-82536
CVE-2026-82536HIGH
Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Adobe Reader 8.1.4/9.1 - 'GetAnnots()' Remote Code Execution
CVE-2009-1492—remotelinux
The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote
28RIESGO
abrir ↗
Referência
CVE-2010-5000
CVE-2010-5000—
SQL injection vulnerability in login/login_index.php in MCLogin System 1.1 and 1.2 allows remote attackers to execute ar
23RIESGO
abrir ↗
Referência
CVE-2026-86670
CVE-2026-86670MEDIUM
aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash
33RIESGO
abrir ↗
Referência
CVE-2014-10038
CVE-2014-10038—
SQL injection vulnerability in agenda/indexdate.php in DomPHP 0.83 and earlier allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência
Sanitized XenForo write-up and proof of concept for CVE-2026-73320.
CVE-2026-73320MEDIUM
XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
33RIESGO
abrir ↗
Referência
CVE-2023-22518
CVE-2023-22518CRITICALbajo ataqueransomware
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authoriz
100RIESGO
abrir ↗
Referência
CVE-2021-1498
CVE-2021-1498CRITICALbajo ataque
Cisco HyperFlex HX Command Injection Vulnerabilities
100RIESGO
abrir ↗
← anteriorpágina 447 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.