Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.449exploits catalogados
35.552CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.451Referência 22.367GitHub PoC 14.225VulnCheck XDB 8649Nuclei 4283Metasploit 3474✓ solo verificadosrecientespopularesriesgo
22.367 exploits
Referência
CVE-2026-16583
CVE-2026-16583MEDIUM
Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload
33RIESGO
abrir ↗
Referência
CVE-2026-16573
CVE-2026-16573HIGH
Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload
41RIESGO
abrir ↗
Referência✓ VexDay Proof
X.Org xorg-x11-xfs 1.0.2-3.1 - Local Race Condition
CVE-2007-3103—locallinux
The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Kravchuk letter script 1.0 - 'scdir' Remote File Inclusion
CVE-2007-3118—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Kravchuk letter (K-letter) 1.0 allow remote attackers to execute a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Kartli Alisveris Sistemi 1.0 - SQL Injection
CVE-2007-3119—webappsasp
SQL injection vulnerability in news.asp in Kartli Alisveris Sistemi (aka Free-PayPal-Shopping-Cart) 1.0 allows remote at
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Quick.Cart 2.2 - Local/Remote File Inclusion / Remote Code Execution
CVE-2007-3138—webappsphp
Directory traversal vulnerability in index.php in Open Solution Quick.Cart 2.2 and earlier allows remote attackers to in
23RIESGO
abrir ↗
Referência
CVE-2017-17611
CVE-2017-17611—
Doctor Search Script 1.0 has SQL Injection via the /list city parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Quick.Cart 2.2 - Local/Remote File Inclusion / Remote Code Execution
CVE-2007-3139—webappsphp
config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Yahoo! Messenger Webcam 8.1 - ActiveX Remote Buffer Overflow (2)
CVE-2007-3148—remotewindows
Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows
28RIESGO
abrir ↗
Referência
CVE-2025-71408
CVE-2025-71408HIGH
NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments
41RIESGO
abrir ↗
Referência
CVE-2026-63100
CVE-2026-63100HIGH
Maybe 0.6.0 Missing Authorization via HostingsController show/update
41RIESGO
abrir ↗
Referência
CVE-2026-63099
CVE-2026-63099HIGH
TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints
41RIESGO
abrir ↗
Referência
CVE-2026-63096
CVE-2026-63096MEDIUM
Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-63095
CVE-2026-63095HIGH
Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint
41RIESGO
abrir ↗
Referência
CVE-2026-63094
CVE-2026-63094HIGH
SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft
41RIESGO
abrir ↗
Referência
CVE-2026-16017
CVE-2026-16017MEDIUM
mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization
33RIESGO
abrir ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-16014
CVE-2026-16014MEDIUM
code-projects Hospital Bed Management System Login Form sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-16013
CVE-2026-16013MEDIUM
liftoff-sr CIPster cipepath.cc deserialize_symbolic out-of-bounds
33RIESGO
abrir ↗
Referência✓ VexDay Proof
QuickTicket 1.2 - 'qti_checkname.php' Local File Inclusion
CVE-2007-3547—webappsphp
Directory traversal vulnerability in qti_checkname.php in QuickTicket 1.2 allows remote attackers to include and execute
23RIESGO
abrir ↗
Referência
CVE-2017-17632
CVE-2017-17632—
Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Buddy Zone 1.5 - 'view_sub_cat.php?cat_id' SQL Injection
CVE-2007-3549—webappsphp
SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL comma
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WebChat 0.78 - 'login.php?rid' SQL Injection
CVE-2007-3534—webappsphp
SQL injection vulnerability in login.php in WebChat 0.78 allows remote attackers to execute arbitrary SQL commands via t
23RIESGO
abrir ↗
Referência
CVE-2017-17634
CVE-2017-17634—
Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
b1gbb 2.24.0 - SQL Injection / Cross-Site Scripting
CVE-2007-3589—webappsphp
Multiple SQL injection vulnerabilities in b1gbb 2.24.0 allow remote attackers to execute arbitrary SQL commands via the
23RIESGO
abrir ↗
Referência✓ VexDay Proof
EnjoySAP ActiveX rfcguisink.rfcguisink.1 - Remote Heap Overflow (PoC)
CVE-2007-3607—doswindows
Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to cause a denia
23RIESGO
abrir ↗
Referência✓ VexDay Proof
EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)
CVE-2007-3608—doswindows
Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to create certai
23RIESGO
abrir ↗
← anteriorpágina 461 / 746siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.