Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2011-2841
CVE-2011-2841—
Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing of PDF documents, w
23RIESGO
abrir ↗
Referência
CVE-2014-0997
CVE-2014-0997—
WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used i
23RIESGO
abrir ↗
Referência
CVE-2026-78656
CVE-2026-78656MEDIUM
itsourcecode Sales and Inventory System cust_del.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-8230
CVE-2026-8230MEDIUM
Wavlink NU516U1 login.cgi sys_login1 os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-12798
CVE-2026-12798MEDIUM
BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-12772
CVE-2026-12772MEDIUM
BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration
33RIESGO
abrir ↗
Referência
CVE-2014-5073
CVE-2014-5073—
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands
60RIESGO
abrir ↗
Referência✓ VexDay Proof
PlaySms 0.9.3 - Multiple Local/Remote File Inclusions
CVE-2008-5881—webappsphp
Multiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary lo
23RIESGO
abrir ↗
Referência
CVE-2014-1564
CVE-2014-1564—
Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize m
23RIESGO
abrir ↗
Referência
CVE-2014-1618
CVE-2014-1618—
Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência
CVE-2017-11120
CVE-2017-11120—
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
23RIESGO
abrir ↗
Referência
CVE-2026-14743
CVE-2026-14743MEDIUM
code-projects Real State Services normalHomeSale.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2018-25435
CVE-2018-25435MEDIUM
ZeusCart 4.0 Deactivate Customer Accounts CSRF
33RIESGO
abrir ↗
Referência
CVE-2026-78198
CVE-2026-78198MEDIUM
SourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
phpMyWebmin 1.0 - 'target' Remote File Inclusion
CVE-2006-5181—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Joshua Muheim phpMyWebmin 1.0 allow remote attackers to execute ar
23RIESGO
abrir ↗
Referência
CVE-2016-6277
CVE-2016-6277HIGHbajo ataque
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.B
100RIESGO
abrir ↗
Referência
CVE-2017-0089
CVE-2017-0089—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
35RIESGO
abrir ↗
Referência
CVE-2016-6283
CVE-2016-6283—
Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitra
23RIESGO
abrir ↗
Referência
CVE-2026-10766
CVE-2026-10766LOW
mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash
28RIESGO
abrir ↗
Referência
CVE-2017-0091
CVE-2017-0091—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RIESGO
abrir ↗
Referência
CVE-2026-10237
CVE-2026-10237MEDIUM
SourceCodester Water Billing Management System User Management manage_user sql injection
33RIESGO
abrir ↗
Referência
CVE-2017-0083
CVE-2017-0083—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
35RIESGO
abrir ↗
Referência✓ VexDay Proof
Travelsized CMS 0.4 - 'FrontPage.php' Remote File Inclusion
CVE-2006-5182—webappsphp
PHP remote file inclusion vulnerability in frontpage.php in Dan Jensen Travelsized CMS 0.4 and earlier allows remote att
23RIESGO
abrir ↗
Referência
CVE-2026-78197
CVE-2026-78197MEDIUM
SourceCodester Simple Online Food Ordering System ajax.php save_user sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Ol BookMarks Manager 0.7.4 - SQL Injection
CVE-2007-2817—webappsphp
SQL injection vulnerability in read/index.php in ol'bookmarks 0.7.4 allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Active Web Mail 4 - Authentication Bypass
CVE-2008-5973—webappsasp
SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2015-6967
CVE-2015-6967—
Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to
50RIESGO
abrir ↗
Referência
CVE-2006-5190
CVE-2006-5190—
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t
23RIESGO
abrir ↗
Referência
CVE-2026-7721
CVE-2026-7721MEDIUM
Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection
33RIESGO
abrir ↗
Referência
CVE-2026-7720
CVE-2026-7720MEDIUM
Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection
33RIESGO
abrir ↗
← anteriorpágina 518 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.