Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
77.449exploits catalogados
35.552CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.451Referência 22.367GitHub PoC 14.225VulnCheck XDB 8649Nuclei 4283Metasploit 3474✓ solo verificadosrecientespopularesriesgo
22.367 exploits
Referência✓ VexDay Proof
Pre Job Board - 'JobSearch.php' SQL Injection
Multiple SQL injection vulnerabilities in jobseekers/JobSearch.php (aka the search module) in Pre Job Board allow remote
23RIESGO
abrir ↗Referência✓ VexDay Proof
Pre ADS Portal 2.0 - SQL Injection
Multiple SQL injection vulnerabilities in Pre ADS Portal 2.0 and earlier, when magic_quotes_gpc is disabled, allow remot
23RIESGO
abrir ↗Referência✓ VexDay Proof
Visual Basic Enterprise Edition SP6 - 'vb6skit.dll' Buffer Overflow (PoC)
Buffer overflow in a certain ActiveX control (vb6skit.dll) in Microsoft Visual Basic Enterprise Edition 6.0 SP6 might al
28RIESGO
abrir ↗Referência✓ VexDay Proof
CMS Mini 0.2.2 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrar
23RIESGO
abrir ↗Referência
CVE-2026-13539
Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow
41RIESGO
abrir ↗Referência
CVE-2026-13538
Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection
33RIESGO
abrir ↗Referência
CVE-2026-13534
CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization
28RIESGO
abrir ↗Referência✓ VexDay Proof
Joomla! Component Brightcode Weblinks - 'catid' SQL Injection
SQL injection vulnerability in Brightcode Weblinks (com_brightweblinks) component for Joomla! allows remote attackers to
23RIESGO
abrir ↗Referência✓ VexDay Proof
Kasseler CMS 1.3.0 - Local File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attacker
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated us
23RIESGO
abrir ↗Referência✓ VexDay Proof
Mole Group Real Estate Script 1.1 - SQL Injection
SQL injection vulnerability in index.php in Mole Group Real Estate Script 1.1 and earlier allows remote attackers to exe
23RIESGO
abrir ↗Referência✓ VexDay Proof
Mole Group Hotel Script 1.0 - SQL Injection
SQL injection vulnerability in index.php in Mole Group Hotel Script 1.0 allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗Referência✓ VexDay Proof
Mole Group Last Minute Script 4.0 - SQL Injection
SQL injection vulnerability in index.php in Mole Group Lastminute Script 4.0 allows remote attackers to execute arbitrar
23RIESGO
abrir ↗Referência✓ VexDay Proof
Pivot 1.40.5 - Dreamwind 'load_template()' Credentials Disclosure
Directory traversal vulnerability in search.php in Pivot 1.40.5 allows remote attackers to read arbitrary files via a ..
23RIESGO
abrir ↗Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in index.php in Catviz 0.4 beta 1 allow remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗Referência
CVE-2026-56789
RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count
41RIESGO
abrir ↗Referência
CVE-2026-56787
RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message
33RIESGO
abrir ↗Referência
CVE-2026-8379
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download
41RIESGO
abrir ↗Referência
CVE-2026-7842
Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter
33RIESGO
abrir ↗Referência
CVE-2026-12823
Browserbase Skills Autobrowse Trace Artifact default permission
33RIESGO
abrir ↗Referência
CVE-2026-12814
Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection
33RIESGO
abrir ↗Referência✓ VexDay Proof
pSys 0.7.0 Alpha - 'chatbox.php' SQL Injection
SQL injection vulnerability in chatbox.php in pSys 0.7.0 Alpha, when magic_quotes_gpc is disabled, allows remote attacke
23RIESGO
abrir ↗Referência✓ VexDay Proof
AShop Deluxe 4.x - 'catalogue.php' SQL Injection
SQL injection vulnerability in catalogue.php in AShop Deluxe 4.x allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗Referência✓ VexDay Proof
SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (2)
SQL injection vulnerability in directory.php in SmartPPC and SmartPPC Pro allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗Referência✓ VexDay Proof
Triton CMS Pro 1.06 - 'x-forwarded-for' Blind SQL Injection
SQL injection vulnerability in Triton CMS Pro allows remote attackers to execute arbitrary SQL commands via the X-Forwar
23RIESGO
abrir ↗Referência✓ VexDay Proof
Fuzzylime CMS 3.01 - Remote Command Execution
Directory traversal vulnerability in rss.php in fuzzylime (cms) 3.01a and earlier, when magic_quotes_gpc is disabled, al
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.