Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-12965
CVE-2026-12965CRITICAL
Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking
48RIESGO
abrir ↗
Referência
CVE-2020-28328
CVE-2020-28328—
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain
50RIESGO
abrir ↗
Referência
CVE-2026-19978
CVE-2026-19978MEDIUM
jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-19960
CVE-2026-19960MEDIUM
Edimax EW-7478APC formWlbasic command injection
33RIESGO
abrir ↗
Referência
CVE-2026-19933
CVE-2026-19933MEDIUM
DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-14230
CVE-2026-14230MEDIUM
ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings
33RIESGO
abrir ↗
Referência
CVE-2026-19932
CVE-2026-19932MEDIUM
DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection
33RIESGO
abrir ↗
Referência
CVE-2026-14229
CVE-2026-14229MEDIUM
ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload
33RIESGO
abrir ↗
Referência
CVE-2016-4135
CVE-2016-4135—
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsof
28RIESGO
abrir ↗
Referência
CVE-2016-4228
CVE-2016-4228—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RIESGO
abrir ↗
Referência✓ VexDay Proof
FreeWPS 2.11 - 'images.php' Remote Code Execution
CVE-2006-1363—webappsphp
images.php in Justin White (aka YTZ) Free Web Publishing System (FreeWPS) 2.11 allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2026-19925
CVE-2026-19925MEDIUM
SourceCodester Stock Management System Master.php delete_supplier sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
XHP CMS 0.5 - 'upload' Remote Command Execution
CVE-2006-1371—webappsphp
Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea Fil
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpBB SpamBlocker Mod 1.0.2 - Remote File Inclusion
CVE-2006-5301—webappsphp
PHP remote file inclusion vulnerability in includes/antispam.php in the SpamBlockerMODv 1.0.2 and earlier module for php
23RIESGO
abrir ↗
Referência
CVE-2016-4313
CVE-2016-4313—
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Transmit.app 3.5.5 - 'ftps://' URL Handler Heap Buffer Overflow (PoC)
CVE-2007-0020—dososx
Heap-based buffer overflow in the SFTP protocol handler for Panic Transmit (Transmit.app) up to 3.5.5 allows remote atta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (1)
CVE-2008-0623—remotewindows
Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (2)
CVE-2008-0623—remotewindows
Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows
23RIESGO
abrir ↗
Referência
CVE-2016-4437
CVE-2016-4437CRITICALbajo ataque
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack
100RIESGO
abrir ↗
Referência
CVE-2016-1525
CVE-2016-1525—
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RIESGO
abrir ↗
Referência
CVE-2019-1619
CVE-2019-1619CRITICAL
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RIESGO
abrir ↗
Referência
CVE-2019-16117
CVE-2019-16117—
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admi
23RIESGO
abrir ↗
Referência
CVE-2026-93309
CVE-2026-93309MEDIUM
O-RAN-SC SMO OAM VES Collector allocation of resources
33RIESGO
abrir ↗
Referência
CVE-2026-63764
CVE-2026-63764HIGH
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
41RIESGO
abrir ↗
Referência
CVE-2019-16119
CVE-2019-16119—
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/control
28RIESGO
abrir ↗
Referência
CVE-2019-1620
CVE-2019-1620CRITICAL
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RIESGO
abrir ↗
Referência
CVE-2014-10079
CVE-2014-10079—
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hid
23RIESGO
abrir ↗
Referência
CVE-2026-93454
CVE-2026-93454MEDIUM
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
33RIESGO
abrir ↗
Referência✓ VexDay Proof
ig shop 1.0 - Code Execution / SQL Injection
CVE-2007-0134—webappsphp
Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the
28RIESGO
abrir ↗
Referência
CVE-2026-92920
CVE-2026-92920MEDIUM
admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled
33RIESGO
abrir ↗
← anteriorpágina 577 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.