Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2017-9730
CVE-2017-9730—
SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2026-84430
CVE-2026-84430MEDIUM
gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes
33RIESGO
abrir ↗
Referência
Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting
CVE-2020-15599—webappsphp
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
23RIESGO
abrir ↗
Referência
CVE-2018-7658
CVE-2018-7658—
NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service
35RIESGO
abrir ↗
Referência✓ VexDay Proof
X-Cart - Multiple Remote File Inclusions
CVE-2007-4907—webappsphp
Multiple PHP remote file inclusion vulnerabilities in X-Cart allow remote attackers to execute arbitrary PHP code via a
23RIESGO
abrir ↗
Referência
CVE-2017-7953
CVE-2017-7953—
INFOR EAM V11.0 Build 201410 has XSS via comment fields.
23RIESGO
abrir ↗
Referência
CVE-2017-7981
CVE-2017-7981—
Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project W
28RIESGO
abrir ↗
Referência
CVE-2026-82876
CVE-2026-82876CRITICAL
Phison PS3111-S11 Controller Firmware Signature Verification Bypass
48RIESGO
abrir ↗
Referência
CVE-2020-16040
CVE-2020-16040—
Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially explo
60RIESGO
abrir ↗
Referência✓ VexDay Proof
Valdersoft Shopping Cart 3.0 - Multiple Remote File Inclusions
CVE-2006-6691—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Valdersoft Shopping Cart 3.0 and earlier allow remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2020-17456
CVE-2020-17456—
SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi pa
60RIESGO
abrir ↗
Referência
CVE-2026-82214
CVE-2026-82214MEDIUM
Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download
33RIESGO
abrir ↗
Referência
CVE-2026-118638
CVE-2026-118638HIGH
Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route
41RIESGO
abrir ↗
Referência
CVE-2026-82526
CVE-2026-82526CRITICAL
R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint
48RIESGO
abrir ↗
Referência✓ VexDay Proof
Kodak Image Viewer - TIF/TIFF Code Execution (MS07-055)
CVE-2007-2217—localwindows
Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote at
35RIESGO
abrir ↗
Referência✓ VexDay Proof
Linksys SPA941 - Remote Reboot (Denial of Service)
CVE-2007-2270—doshardware
The Linksys SPA941 VoIP Phone allows remote attackers to cause a denial of service (device reboot) via a 0377 (0xff) cha
23RIESGO
abrir ↗
Referência
CVE-2026-118629
CVE-2026-118629MEDIUM
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-85110
CVE-2026-85110HIGH
Tenda HG10 Boa Web Server formWlanSetup buffer overflow
41RIESGO
abrir ↗
Referência✓ VexDay Proof
USP FOSS Distribution 1.01 - 'dnld' Remote File Disclosure
CVE-2007-2271—webappsphp
Directory traversal vulnerability in Rajneel Lal TotaRam USP FOSS Distribution 1.01 allows remote attackers to read arbi
23RIESGO
abrir ↗
Referência
CVE-2026-85109
CVE-2026-85109CRITICAL
Tenda HG10 Boa Web Server formLogin buffer overflow
48RIESGO
abrir ↗
Referência
Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting
CVE-2020-29477—webappsmultiple
Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow
23RIESGO
abrir ↗
Referência
CVE-2020-29607
CVE-2020-29607—
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access
35RIESGO
abrir ↗
Referência
CVE-2022-24734
CVE-2022-24734HIGH
Remote code execution in mybb
78RIESGO
abrir ↗
Referência✓ VexDay Proof
ACGVAnnu 1.3 - 'acgv.php?rubrik' Local File Inclusion
CVE-2007-2560—webappsphp
Directory traversal vulnerability in theme/acgv.php in ACGVannu 1.3 and earlier allows remote attackers to read arbitrar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Wikivi5 - 'show.php?sous_rep' Remote File Inclusion
CVE-2007-2570—webappsphp
PHP remote file inclusion vulnerability in handlers/page/show.php in Wikivi5 allows remote attackers to execute arbitrar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
runawaysoft haber portal 1.0 - 'tr' Multiple Vulnerabilities
CVE-2007-2753—webappsasp
RunawaySoft Haber portal 1.0 stores sensitive information under the web root with insufficient access control, which all
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Build it Fast (bif3) 0.4.1 - Multiple Remote File Inclusions
CVE-2007-2762—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Build it Fast (bif3) 0.4.1 allow remote attackers to execute arbit
23RIESGO
abrir ↗
Referência
CVE-2017-8601
CVE-2017-8601—
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute
35RIESGO
abrir ↗
Referência
CVE-2017-8636
CVE-2017-8636—
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Serve
45RIESGO
abrir ↗
Referência
CVE-2017-8636
CVE-2017-8636—
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Serve
45RIESGO
abrir ↗
← anteriorpágina 535 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.