Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.240 exploits
Referência
CVE-2026-10165
CVE-2026-10165HIGH
Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2024-6039
CVE-2024-6039MEDIUM
Feng Office Workspaces sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-113499
CVE-2026-113499HIGH
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
41RIESGO
abrir ↗
Referência
CVE-2026-66754
CVE-2026-66754HIGH
Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Claroline 1.7.6 - 'includePath' Remote Code Execution
CVE-2006-2868—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.6 allow remote attackers to execute arbitrary PHP co
28RIESGO
abrir ↗
Referência
CVE-2026-113472
CVE-2026-113472MEDIUM
Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload
33RIESGO
abrir ↗
Referência✓ VexDay Proof
OneCMS 2.4 - SQL Injection / Upload
CVE-2008-7208—webappsphp
Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2009-3512
CVE-2009-3512—
Multiple cross-site scripting (XSS) vulnerabilities in MyWeight 1.0 allow remote attackers to inject arbitrary web scrip
23RIESGO
abrir ↗
Referência
CVE-2026-5978
CVE-2026-5978CRITICAL
Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection
48RIESGO
abrir ↗
Referência
CVE-2017-15981
CVE-2017-15981—
Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for fo
23RIESGO
abrir ↗
Referência
CVE-2017-15982
CVE-2017-15982—
Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (1)
CVE-2007-3587—webappsphp
MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
AuraCMS 2.2 - 'albums' Pramater SQL Injection
CVE-2008-0735—webappsphp
SQL injection vulnerability in mod/gallery/ajax/gallery_data.php in AuraCMS 2.2 allows remote attackers to execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Yblog 0.2.2.2 - Cross-Site Scripting / SQL Injection
CVE-2008-2668—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in yBlog 0.2.2.2 allow remote attackers to inject arbitrary web scri
23RIESGO
abrir ↗
Referência
CVE-2010-1928
CVE-2010-1928—
Directory traversal vulnerability in scr/soustab.php in openMairie openPlanning 1.00, when register_globals is enabled,
23RIESGO
abrir ↗
Referência
CVE-2010-1936
CVE-2010-1936—
Directory traversal vulnerability in scr/soustab.php in openMairie openComInterne 1.01, when register_globals is enabled
23RIESGO
abrir ↗
Referência
CVE-2019-9553
CVE-2019-9553—
Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and
23RIESGO
abrir ↗
Referência
CVE-2020-14166
CVE-2020-14166—
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remo
23RIESGO
abrir ↗
Referência
CVE-2022-37061
CVE-2022-37061—
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This
60RIESGO
abrir ↗
Referência✓ VexDay Proof
aspwebalbum 3.2 - Multiple Vulnerabilities
CVE-2008-6977—webappsasp
Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inje
23RIESGO
abrir ↗
Referência
CVE-2026-115537
CVE-2026-115537MEDIUM
gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect
33RIESGO
abrir ↗
Referência
CVE-2026-115536
CVE-2026-115536MEDIUM
gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2011-1062
CVE-2011-1062—
Multiple cross-site scripting (XSS) vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attacker
23RIESGO
abrir ↗
Referência
CVE-2015-7387
CVE-2015-7387—
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
60RIESGO
abrir ↗
Referência
CVE-2016-1336
CVE-2016-1336—
goform/Docsis_system on Cisco EPC3928 devices allows remote attackers to cause a denial of service (device crash) via a
23RIESGO
abrir ↗
Referência
CVE-2017-16001
CVE-2017-16001—
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently su
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Kjtechforce mailman b1 - Delete Row 'code' SQL Injection
CVE-2009-2164—webappsphp
Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote att
23RIESGO
abrir ↗
Referência
CVE-2016-1464
CVE-2016-1464—
Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to execute arbitrary code
23RIESGO
abrir ↗
Referência
CVE-2010-4837
CVE-2010-4837—
Cross-site scripting (XSS) vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote attack
23RIESGO
abrir ↗
Referência
CVE-2015-7547
CVE-2015-7547—
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
45RIESGO
abrir ↗
← anteriorpágina 466 / 875siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.