Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2021-36260
CVE-2021-36260CRITICALbajo ataque
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,
100RIESGO
abrir ↗
Referência
CVE-2026-10873
CVE-2026-10873HIGH
Shibby Tomato Web UI rstats rstats_path os command injection
41RIESGO
abrir ↗
Referência
CVE-2018-1111
CVE-2018-1111HIGH
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in
78RIESGO
abrir ↗
Referência✓ VexDay Proof
PhotoKorn Gallery 1.543 - 'pic' SQL Injection
CVE-2008-0614—webappsphp
SQL injection vulnerability in index.php in Photokorn Gallery 1.543 allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência✓ VexDay Proof
NERO Media Player 1.4.0.35b - '.m3u' File Buffer Overflow (PoC)
CVE-2008-0619—doswindows
Buffer overflow in NeroMediaPlayer.exe in Nero Media Player 1.4.0.35 and earlier allows remote attackers to execute arbi
28RIESGO
abrir ↗
Referência
CVE-2026-82599
CVE-2026-82599MEDIUM
SeaCMS Avatar Upload member.php unlink path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-10567
CVE-2026-10567MEDIUM
1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2018-25434
CVE-2018-25434HIGH
WP AutoSuggest 0.24 SQL Injection via autosuggest.php
41RIESGO
abrir ↗
Referência
CVE-2018-25433
CVE-2018-25433HIGH
Joomla JE Photo Gallery 1.1 SQL Injection via categoryid
41RIESGO
abrir ↗
Referência
CVE-2018-25432
CVE-2018-25432HIGH
Arm Whois 3.11 Buffer Overflow via ASLR Bypass
41RIESGO
abrir ↗
Referência
CVE-2020-8617
CVE-2020-8617HIGH
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
78RIESGO
abrir ↗
Referência
CVE-2026-10273
CVE-2026-10273MEDIUM
php-censor Webhook Endpoint GitBuild.php os command injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
The Everything Development System Pre-1.0 - SQL Injection
CVE-2008-0675—webappsphp
SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
BlogPHP 2 - 'id' Cross-Site Scripting / SQL Injection
CVE-2008-0679—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in BlogPHP 2.0 allows remote attackers to inject arbitrary web scr
23RIESGO
abrir ↗
Referência
CVE-2018-11510
CVE-2018-11510—
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/
35RIESGO
abrir ↗
Referência
CVE-2018-11510
CVE-2018-11510—
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/
35RIESGO
abrir ↗
Referência
CVE-2021-40868
CVE-2021-40868—
In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
38RIESGO
abrir ↗
Referência
CVE-2021-40868
CVE-2021-40868—
In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
38RIESGO
abrir ↗
Referência
Payara Micro Community 5.2021.6 - Directory Traversal
CVE-2021-41381—webappsmultiple
Payara Micro Community 5.2021.6 and below allows Directory Traversal.
50RIESGO
abrir ↗
Referência
CVE-2026-86060
CVE-2026-86060CRITICALbajo ataque
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Nuke Modules Okul 1.0 - 'okulid' SQL Injection
CVE-2008-0881—webappsphp
SQL injection vulnerability in modules.php in the Okul 1.0 module for PHP-Nuke allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2018-11526
CVE-2018-11526—
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Globsy 1.0 - 'file' Remote File Disclosure
CVE-2008-0905—webappsphp
Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a
23RIESGO
abrir ↗
Referência
CVE-2018-11529
CVE-2018-11529—
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arb
50RIESGO
abrir ↗
Referência
CVE-2026-108693
CVE-2026-108693HIGH
ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate
41RIESGO
abrir ↗
Referência
CVE-2021-21972
CVE-2021-21972CRITICALbajo ataqueransomware
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RIESGO
abrir ↗
Referência
CVE-2026-90504
CVE-2026-90504MEDIUM
vvbbnn00 WARP-Clash-API authorized missing authentication
33RIESGO
abrir ↗
Referência
CVE-2019-0211
CVE-2019-0211HIGHbajo ataque
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privilege
83RIESGO
abrir ↗
Referência✓ VexDay Proof
Eurologon CMS - 'files.php' Arbitrary File Download
CVE-2007-6185—webappsphp
Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files vi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
IP Reg 0.4 - Multiple SQL Injections
CVE-2008-4606—webappsphp
Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
← anteriorpágina 533 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.