Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2026-9062
CVE-2026-9062LOW
Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal
43RIESGO
abrir ↗
Referência
CVE-2018-10366
CVE-2018-10366—
An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the nam
23RIESGO
abrir ↗
Referência
CVE-2026-90606
CVE-2026-90606CRITICAL
Totolink A3002MU boa formIpv6Setup buffer overflow
48RIESGO
abrir ↗
Referência✓ VexDay Proof
PhpCommander 3.0 - 'upload' Remote Code Execution
CVE-2006-4636—webappsphp
Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute a
23RIESGO
abrir ↗
Referência
CVE-2026-65012
CVE-2026-65012MEDIUM
InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder
33RIESGO
abrir ↗
Referência✓ VexDay Proof
WebBuilder 2.0 - 'StageLoader.php' Remote File Inclusion
CVE-2007-0703—webappsphp
PHP remote file inclusion vulnerability in library/StageLoader.php in WebBuilder 2.0 and earlier allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2013-3524
CVE-2013-3524—
SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remot
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Webavis 0.1.1 - 'class.php?root' Remote File Inclusion
CVE-2007-2943—webappsphp
PHP remote file inclusion vulnerability in class/class.php in Webavis 0.1.1 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PBEmail 7 - ActiveX Edition Insecure Method
CVE-2007-5446—remotewindows
Absolute path traversal vulnerability in a certain ActiveX control in PBEmail7Ax.dll in PBEmail 7 ActiveX Edition allows
23RIESGO
abrir ↗
Referência✓ VexDay Proof
shibby shop 2.2 - Multiple Vulnerabilities
CVE-2008-2872—webappsphp
SQL injection vulnerability in default.asp in sHibby sHop 2.2 and earlier allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Bonza Cart 1.10 - Admin Password Changing
CVE-2008-5567—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin/ad_settings.php in Bonza Cart 1.10 and earlier allows remote at
23RIESGO
abrir ↗
Referência
CVE-2008-5943
CVE-2008-5943—
Multiple directory traversal vulnerabilities in NavBoard 16 (2.6.0) allow remote attackers to include and execute arbitr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpYabs 0.1.2 - 'Azione' Remote File Inclusion
CVE-2009-0639—webappsphp
PHP remote file inclusion vulnerability in moduli/libri/index.php in phpyabs 0.1.2 allows remote attackers to execute ar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Gigaset SE461 WiMAX Router - Remote Denial of Service
CVE-2009-1152—doshardware
Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a den
23RIESGO
abrir ↗
Referência
CVE-2009-3423
CVE-2009-3423—
login.php in Zenas PaoLink 1.0, when register_globals is enabled, allows remote attackers to bypass authentication and g
23RIESGO
abrir ↗
Referência
CVE-2026-72710
CVE-2026-72710CRITICAL
SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection
48RIESGO
abrir ↗
Referência
CVE-2026-72709
CVE-2026-72709CRITICAL
SPIP < 4.4.18 Missing Authorization via ecrire/action/
48RIESGO
abrir ↗
Referência
CVE-2017-10271
CVE-2017-10271HIGHbajo ataqueransomware
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗
Referência
CVE-2026-17541
CVE-2026-17541HIGH
Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure
41RIESGO
abrir ↗
Referência
CVE-2006-0074
CVE-2006-0074—
SQL injection vulnerability in profile.php in PHPenpals allows remote attackers to execute arbitrary SQL commands via th
23RIESGO
abrir ↗
Referência
CVE-2026-90574
CVE-2026-90574MEDIUM
itsourcecode Sales and Inventory System emp_transac.php add sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-90573
CVE-2026-90573MEDIUM
GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference
33RIESGO
abrir ↗
Referência✓ VexDay Proof
XOOPS Module Tiny Event 1.01 - 'id' SQL Injection
CVE-2007-1811—webappsphp
SQL injection vulnerability in index.php in the Tiny Event (tinyevent) 1.01 and earlier module for Xoops allows remote a
23RIESGO
abrir ↗
Referência
CVE-2016-4314
CVE-2016-4314—
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated admini
28RIESGO
abrir ↗
Referência
CVE-2024-25734
CVE-2024-25734HIGH
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only a
41RIESGO
abrir ↗
Referência
CVE-2026-72708
CVE-2026-72708HIGH
SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html
41RIESGO
abrir ↗
Referência
CVE-2010-0470
CVE-2010-0470—
Cross-site scripting (XSS) vulnerability in scvrtsrv.cmd in Comtrend CT-507IT ADSL Router allows remote attackers to inj
23RIESGO
abrir ↗
Referência
CVE-2014-5101
CVE-2014-5101—
Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script
23RIESGO
abrir ↗
Referência
CVE-2010-2684
CVE-2010-2684—
SQL injection vulnerability in index.php in Customer Paradigm PageDirector CMS allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2019-25670
CVE-2019-25670HIGH
River Past Video Cleaner 7.6.3 Buffer Overflow via SEH
41RIESGO
abrir ↗
← anteriorpágina 450 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.