Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.091exploits catalogados
40.545CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.325Exploit-DB 24.488GitHub PoC 18.053VulnCheck XDB 10.121Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência✓ VexDay Proof
NetRisk 1.9.7 - Cross-Site Scripting / SQL Injection
CVE-2008-0185—webappsphp
SQL injection vulnerability in index.php in NetRisk 1.9.7 and possibly earlier versions allows remote attackers to execu
23RIESGO
abrir ↗
Referência
CVE-2011-5161
CVE-2011-5161—
Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to e
23RIESGO
abrir ↗
Referência
CVE-2011-5165
CVE-2011-5165—
Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem
50RIESGO
abrir ↗
Referência
CVE-2017-3881
CVE-2017-3881CRITICALbajo ataque
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting
CVE-2008-5980—webappsphp
Ocean12 Mailing List Manager Gold stores sensitive data under the web root with insufficient access control, which allow
23RIESGO
abrir ↗
Referência✓ VexDay Proof
IncCMS Core 1.0.0 - 'settings.php' Remote File Inclusion
CVE-2006-5304—webappsphp
PHP remote file inclusion vulnerability in inc/settings.php in IncCMS Core 1.0.0 and earlier allows remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2026-18600
CVE-2026-18600HIGH
GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Tuned Studios Templates - Local File Inclusion
CVE-2008-0231—webappsphp
Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange C
23RIESGO
abrir ↗
Referência
CVE-2009-4905
CVE-2009-4905—
Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Acc Statistics 1.1 allow remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2026-46333
CVE-2026-46333HIGH
ptrace: slightly saner 'get_dumpable()' logic
56RIESGO
abrir ↗
Referência
CVE-2009-4925
CVE-2009-4925—
Multiple SQL injection vulnerabilities in Portale e-commerce Creasito (aka creasito e-commerce content manager) 1.3.16,
23RIESGO
abrir ↗
Referência
CVE-2011-5173
CVE-2011-5173—
Buffer overflow in Bugbear Entertainment FlatOut 2005 allows user-assisted remote attackers to cause a denial of service
23RIESGO
abrir ↗
Referência
CVE-2013-5758
CVE-2013-5758—
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by
28RIESGO
abrir ↗
Referência
CVE-2016-3943
CVE-2016-3943—
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
23RIESGO
abrir ↗
Referência
CVE-2013-5977
CVE-2013-5977—
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordP
23RIESGO
abrir ↗
Referência
CVE-2016-4204
CVE-2016-4204—
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
28RIESGO
abrir ↗
Referência
CVE-2016-4206
CVE-2016-4206—
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
28RIESGO
abrir ↗
Referência
CVE-2026-7238
CVE-2026-7238MEDIUM
code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-7237
CVE-2026-7237MEDIUM
AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7235
CVE-2026-7235MEDIUM
ErlichLiu claude-agent-sdk-master route.ts path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7234
CVE-2026-7234MEDIUM
BrowserOperator browser-operator-core server.js startsWith path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-7233
CVE-2026-7233MEDIUM
Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds
33RIESGO
abrir ↗
Referência
CVE-2026-7226
CVE-2026-7226MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7225
CVE-2026-7225MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php delete_menu sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7224
CVE-2026-7224MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7223
CVE-2026-7223MEDIUM
BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2016-4231
CVE-2016-4231—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RIESGO
abrir ↗
Referência
CVE-2026-15250
CVE-2026-15250MEDIUM
LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
33RIESGO
abrir ↗
Referência
CVE-2018-1000001
CVE-2018-1000001—
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
43RIESGO
abrir ↗
Referência
CVE-2009-3975
CVE-2009-3975—
SQL injection vulnerability in index.php in Moa Gallery 1.1.0 and 1.2.0 allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
← anteriorpágina 481 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.