Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.166exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.078VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-115534
CVE-2026-115534MEDIUM
gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-15557
CVE-2026-15557MEDIUM
waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication
33RIESGO
abrir ↗
Referência✓ VexDay Proof
GameSiteScript 3.1 - profile id SQL Injection
CVE-2007-3631—webappsphp
SQL injection vulnerability in index.php in GameSiteScript (gss) 3.1 and earlier allows remote attackers to execute arbi
23RIESGO
abrir ↗
Referência
CVE-2009-4403
CVE-2009-4403—
Cross-site scripting (XSS) vulnerability in index.php in Rumba XML 1.8 allows remote attackers to inject arbitrary web s
23RIESGO
abrir ↗
Referência✓ VexDay Proof
A-Link WL54AP3 / WL54AP2 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2008-6823—remotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2
23RIESGO
abrir ↗
Referência
CVE-2015-2023
CVE-2015-2023—
Buffer overflow in IBM i Access 7.1 on Windows allows local users to gain privileges via unspecified vectors.
23RIESGO
abrir ↗
Referência
CVE-2009-4793
CVE-2009-4793—
Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authentic
23RIESGO
abrir ↗
Referência
CVE-2014-9226
CVE-2014-9226—
The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security:
23RIESGO
abrir ↗
Referência
CVE-2015-7547
CVE-2015-7547—
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
45RIESGO
abrir ↗
Referência✓ VexDay Proof
Microsoft Windows Wordpad - '.doc' File Local Denial of Service (PoC)
CVE-2009-0259—doswindows
The Word processor in OpenOffice.org 1.1.2 through 1.1.5 allows remote attackers to cause a denial of service (crash) an
23RIESGO
abrir ↗
Referência
CVE-2026-8757
CVE-2026-8757MEDIUM
adenhq hive Delete Request routes_sessions.py _read_events_tail path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-8756
CVE-2026-8756MEDIUM
fishaudio Bert-VITS2 Gradio webui_preprocess.py generate_config path traversal
33RIESGO
abrir ↗
Referência★ 64
FortiWeb CVE-2025-25257 exploit
CVE-2025-25257CRITICALbajo ataque
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RIESGO
abrir ↗
Referência✓ VexDay Proof
WinPcap 4.0 - 'NPF.SYS' Local Privilege Escalation
CVE-2007-3681—localwindows
The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite
23RIESGO
abrir ↗
Referência
CVE-2007-4434
CVE-2007-4434—
Cross-site scripting (XSS) vulnerability in textfilesearch.asp in the Text File Search ASP (Classic) edition allows remo
23RIESGO
abrir ↗
Referência✓ VexDay Proof
427bb 2.3.1 - SQL Injection / Cross-Site Scripting
CVE-2008-2561—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in 427BB 2.3.1 allow remote attackers to inject arbitrary web script
23RIESGO
abrir ↗
Referência
CVE-2026-71963
CVE-2026-71963HIGH
Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
41RIESGO
abrir ↗
Referência✓ VexDay Proof
ourvideo CMS 9.5 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2979—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in phpi/login.php in Ourvideo CMS 9.5 allow remote attackers to inje
23RIESGO
abrir ↗
Referência
CVE-2018-25334
CVE-2018-25334MEDIUM
Zechat 1.5 Cross-Site Request Forgery (CSRF) via hashtag parameter
33RIESGO
abrir ↗
Referência✓ VexDay Proof
myPHPNuke < 1.8.8_8rc2 - Cross-Site Scripting / SQL Injection
CVE-2008-4089—webappsphp
Cross-site scripting (XSS) vulnerability in print.php in myPHPNuke (MPN) before 1.8.8_8rc2 allows remote attackers to in
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ClanLite 2.x - SQL Injection / Cross-Site Scripting
CVE-2008-5214—webappsphp
Cross-site scripting (XSS) vulnerability in service/calendrier.php in ClanLite 2.2006.05.20 allows remote attackers to i
23RIESGO
abrir ↗
Referência
CVE-2012-5918
CVE-2012-5918—
razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a
23RIESGO
abrir ↗
Referência
CVE-2013-5656
CVE-2013-5656—
FuzeZip 1.0.0.131625 has a Local Buffer Overflow vulnerability
23RIESGO
abrir ↗
Referência✓ VexDay Proof
isweb CMS 3.0 - SQL Injection / Cross-Site Scripting
CVE-2008-5933—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in CMS ISWEB 3.0 allow remote attackers to inject arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WEBBDOMAIN WebShop 1.02 - SQL Injection / Cross-Site Scripting
CVE-2008-6629—webappsphp
Cross-site scripting (XSS) vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
RS-CMS 2.1 - 'key' SQL Injection
CVE-2009-2209—webappsphp
SQL injection vulnerability in rscms_mod_newsview.php in RS-CMS 2.1 allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência
CVE-2026-13547
CVE-2026-13547MEDIUM
Hanwang e-Face General Management Platform upload.do unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2021-31761
CVE-2021-31761—
Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's ru
35RIESGO
abrir ↗
Referência
CVE-2026-13516
CVE-2026-13516HIGH
Tenda JD12L WifiGuestSet fromSetWifiGusetBasic stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2026-83533
CVE-2026-83533MEDIUM
WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment
33RIESGO
abrir ↗
← anteriorpágina 496 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.