Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.166exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.078VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
Microsoft Windows Server 2016 - Win32k Elevation of Privilege
CVE-2023-29336HIGHbajo ataquelocalwindows
Win32k Elevation of Privilege Vulnerability
83RIESGO
abrir ↗
Referência
CVE-2012-5348
CVE-2012-5348—
SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via th
23RIESGO
abrir ↗
Referência
CVE-2022-50970
CVE-2022-50970MEDIUM
WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-111230
CVE-2026-111230MEDIUM
Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
33RIESGO
abrir ↗
Referência
CVE-2026-111228
CVE-2026-111228MEDIUM
Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php
33RIESGO
abrir ↗
Referência
CVE-2012-5387
CVE-2012-5387—
Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordP
23RIESGO
abrir ↗
Referência
CVE-2012-5900
CVE-2012-5900—
Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2014-2623
CVE-2014-2623—
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
60RIESGO
abrir ↗
Referência
CVE-2023-33584
CVE-2023-33584CRITICAL
Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to
53RIESGO
abrir ↗
Referência
CVE-2023-34581
CVE-2023-34581—
Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/
23RIESGO
abrir ↗
Referência
CVE-2008-2335
CVE-2008-2335—
Cross-site scripting (XSS) vulnerability in search_results.php in Vastal I-Tech phpVID 1.1 and 1.2 allows remote attacke
23RIESGO
abrir ↗
Referência✓ VexDay Proof
cPanel WebHost Manager (WHM) - '/webmail/x3/mail/clientconf.html?acct' Cross-Site Scripting
CVE-2012-6448—webappsphp
Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web scrip
23RIESGO
abrir ↗
Referência
CVE-2026-76050
CVE-2026-76050MEDIUM
SourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injection
33RIESGO
abrir ↗
Referência
CVE-2018-7289
CVE-2018-7289—
An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames cont
23RIESGO
abrir ↗
Referência
CVE-2015-4481
CVE-2015-4481—
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Win
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPRaider 1.0.7 - 'PHPbb3.functions.php' Remote File Inclusion
CVE-2008-2481—webappsphp
PHP remote file inclusion vulnerability in authentication/phpbb3/phpbb3.functions.php in phpRaider 1.0.7 and 1.0.7a, whe
23RIESGO
abrir ↗
Referência
CVE-2015-7084
CVE-2015-7084—
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to g
23RIESGO
abrir ↗
Referência
CVE-2025-55315
CVE-2025-55315CRITICAL
ASP.NET Security Feature Bypass Vulnerability
60RIESGO
abrir ↗
Referência✓ VexDay Proof
Xomol CMS 1.2 - Authentication Bypass / Local File Inclusion
CVE-2008-2483—webappsphp
Directory traversal vulnerability in index.php in Xomol CMS 1.20071213 allows remote attackers to include and execute ar
23RIESGO
abrir ↗
Referência
CVE-2015-7110
CVE-2015-7110—
The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or caus
23RIESGO
abrir ↗
Referência
CVE-2018-7477
CVE-2018-7477—
SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/
23RIESGO
abrir ↗
Referência
CVE-2026-41473
CVE-2026-41473HIGH
CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints
41RIESGO
abrir ↗
Referência
CVE-2026-41472
CVE-2026-41472MEDIUM
CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard
33RIESGO
abrir ↗
Referência
CVE-2026-41414
CVE-2026-41414HIGH
Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml
41RIESGO
abrir ↗
Referência
CVE-2026-39920
CVE-2026-39920CRITICAL
BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE
48RIESGO
abrir ↗
Referência
CVE-2026-31635
CVE-2026-31635HIGH
rxrpc: fix oversized RESPONSE authenticator length check
41RIESGO
abrir ↗
Referência
CVE-2026-6981
CVE-2026-6981MEDIUM
IhateCreatingUserNames2 AiraHub2 Endpoint AiraHub.py sync_agents server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-6980
CVE-2026-6980MEDIUM
Divyanshu-hash GitPilot-MCP main.py repo_path command injection
33RIESGO
abrir ↗
Referência
CVE-2026-6979
CVE-2026-6979MEDIUM
devlikeapro WAHA API Request media.controller.ts server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-6978
CVE-2026-6978MEDIUM
JiZhiCMS addcache.html htmlspecialchars_decode sql injection
33RIESGO
abrir ↗
← anteriorpágina 500 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.