Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.166exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.078VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência✓ VexDay Proof
Wheatblog 1.1 - 'session.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/session.php in Wheatblog (wB) 1.1 and earlier, when register_globals
23RIESGO
abrir ↗Referência✓ VexDay Proof
WebSPELL 4.01.02 - 'picture.php' File Disclosure
picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter.
23RIESGO
abrir ↗Referência
CVE-2016-3223
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an
28RIESGO
abrir ↗Referência
CVE-2018-12055
Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.ph
23RIESGO
abrir ↗Referência
CVE-2018-10256
A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile
23RIESGO
abrir ↗Referência
CVE-2018-10259
An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged u
23RIESGO
abrir ↗Referência
CVE-2026-91854
code-projects Record Management System reg.php cross site scripting
33RIESGO
abrir ↗Referência
CVE-2018-9948
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader
50RIESGO
abrir ↗Referência
CVE-2018-9958
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1
50RIESGO
abrir ↗Referência✓ VexDay Proof
WTcom 0.2.4-alpha - 'torrents.php' SQL Injection
SQL injection vulnerability in torrents.php in WebTorrent (WTcom) 0.2.4 and earlier allows remote attackers to execute a
23RIESGO
abrir ↗Referência
CVE-2026-91849
WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload
33RIESGO
abrir ↗Referência
CVE-2026-91089
GPAC base_scenegraph.c gf_node_get_name_and_id use after free
33RIESGO
abrir ↗Referência
CVE-2026-91087
GPAC Compositor media_object.c gf_mo_get_od_id use after free
33RIESGO
abrir ↗Referência✓ VexDay Proof
XOOPS Module WF-Links 1.03 - 'cid' SQL Injection
SQL injection vulnerability in viewcat.php in the WF-Links (wflinks) 1.03 and earlier module for XOOPS allows remote att
23RIESGO
abrir ↗Referência
CVE-2019-1003002
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src
60RIESGO
abrir ↗Referência✓ VexDay Proof
Integramod Portal 2.x - 'functions_portal.php' Remote File Inclusion
Absolute path traversal vulnerability in includes/functions_portal.php in IntegraMOD Portal 2.x and earlier, when magic_
23RIESGO
abrir ↗Referência
CVE-2026-14835
SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox
33RIESGO
abrir ↗Referência
TeemIp IPAM < 2.4.0 - 'new_config' Command Injection (Metasploit)
A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows on
28RIESGO
abrir ↗Referência
CVE-2019-10867
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/c
50RIESGO
abrir ↗Referência✓ VexDay Proof
pSlash 0.7 - 'lvc_include_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/visitors2/include/config.inc.php in pSlash 0.70 allows remote attacke
23RIESGO
abrir ↗Referência
CVE-2026-18897
UTT HiPER 1250GW getOneApConfTempEntry strcpy stack-based overflow
41RIESGO
abrir ↗Referência
CVE-2026-82424
PHPGurukul Student Information System student_edit1.php sql injection
33RIESGO
abrir ↗Referência
CVE-2026-82422
itsourcecode Sales and Inventory System emp_del.php sql injection
33RIESGO
abrir ↗Referência✓ VexDay Proof
TinyIdentD 2.2 - Remote Buffer Overflow
Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long s
50RIESGO
abrir ↗Referência
CVE-2016-7089
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHPGlossar 0.8 - 'format_menue' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in PHPGlossar 0.8 allow remote attackers to execute arbitrary PHP cod
23RIESGO
abrir ↗Referência
Joomla! Component Saxum Picker 3.2.10 - SQL Injection
SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter.
23RIESGO
abrir ↗Referência
Liferay CE Portal < 7.1.2 ga3 - Remote Command Execution (Metasploit)
An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute O
28RIESGO
abrir ↗Referência
CVE-2017-17594
DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter.
23RIESGO
abrir ↗Referência
OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)
OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move tha
28RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.