Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.166exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.078VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2009-4925
CVE-2009-4925—
Multiple SQL injection vulnerabilities in Portale e-commerce Creasito (aka creasito e-commerce content manager) 1.3.16,
23RIESGO
abrir ↗
Referência
CVE-2011-5173
CVE-2011-5173—
Buffer overflow in Bugbear Entertainment FlatOut 2005 allows user-assisted remote attackers to cause a denial of service
23RIESGO
abrir ↗
Referência
CVE-2013-5758
CVE-2013-5758—
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by
28RIESGO
abrir ↗
Referência
CVE-2016-3943
CVE-2016-3943—
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
23RIESGO
abrir ↗
Referência
CVE-2026-8215
CVE-2026-8215MEDIUM
Industrial Application Software IAS Canias ERP RMI iasRequestFileEvent path traversal
33RIESGO
abrir ↗
Referência
CVE-2010-3602
CVE-2010-3602—
Cross-site scripting (XSS) vulnerability in ProfileView.aspx in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers t
23RIESGO
abrir ↗
Referência
CVE-2021-28420
CVE-2021-28420—
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and th
23RIESGO
abrir ↗
Referência
CVE-2021-28935
CVE-2021-28935—
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > M
23RIESGO
abrir ↗
Referência
CVE-2021-29447
CVE-2021-29447HIGH
WordPress Authenticated XXE attack when installation is running PHP 8
63RIESGO
abrir ↗
Referência
CVE-2009-3812
CVE-2009-3812—
Heap-based buffer overflow in OtsAV DJ trial version 1.85.64.0, Radio trial version 1.85.64.0, TV trial version 1.85.64.
23RIESGO
abrir ↗
Referência
CVE-2026-8210
CVE-2026-8210MEDIUM
aandrew-me tgpt Update helper.go helper.Update command injection
33RIESGO
abrir ↗
Referência
CVE-2011-5211
CVE-2011-5211—
Cross-site scripting (XSS) vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbit
23RIESGO
abrir ↗
Referência
CVE-2026-8196
CVE-2026-8196MEDIUM
JeecgBoot mLogin Endpoint LoginController.java authorization
33RIESGO
abrir ↗
Referência
CVE-2016-4137
CVE-2016-4137—
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsof
28RIESGO
abrir ↗
Referência✓ VexDay Proof
JaxUltraBB 2.0 - 'delete.php' Remote Auto Deface
CVE-2006-5511—webappsphp
Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0, when register_globals is enabled, all
23RIESGO
abrir ↗
Referência
CVE-2016-4207
CVE-2016-4207—
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
28RIESGO
abrir ↗
Referência✓ VexDay Proof
SuperNET Shop 1.0 - SQL Injection
CVE-2008-6204—webappsasp
Multiple SQL injection vulnerabilities in SuperNET Shop 1.0 and earlier allow remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2010-3603
CVE-2010-3603—
Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.
23RIESGO
abrir ↗
Referência
CVE-2010-3608
CVE-2010-3608—
Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the (1
23RIESGO
abrir ↗
Referência
CVE-2026-7226
CVE-2026-7226MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7225
CVE-2026-7225MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php delete_menu sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7224
CVE-2026-7224MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-7223
CVE-2026-7223MEDIUM
BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2016-4231
CVE-2016-4231—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RIESGO
abrir ↗
Referência
CVE-2026-86228
CVE-2026-86228MEDIUM
JeecgBoot AiragModelController.java exportXls access control
33RIESGO
abrir ↗
Referência
CVE-2026-15250
CVE-2026-15250MEDIUM
LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
33RIESGO
abrir ↗
Referência
CVE-2026-86227
CVE-2026-86227LOW
valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds
28RIESGO
abrir ↗
Referência
CVE-2018-1000001
CVE-2018-1000001—
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
43RIESGO
abrir ↗
Referência
CVE-2026-86225
CVE-2026-86225MEDIUM
SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-86224
CVE-2026-86224MEDIUM
SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injection
33RIESGO
abrir ↗
← anteriorpágina 512 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.