Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.900exploits catalogados
35.840CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.600GitHub PoC 14.323VulnCheck XDB 8722Nuclei 4320Metasploit 3477✓ solo verificadosrecientespopularesriesgo
22.600 exploits
Referência
CVE-2010-1718
CVE-2010-1718—
Directory traversal vulnerability in archeryscores.php in the Archery Scores (com_archeryscores) component 1.0.6 for Joo
38RIESGO
abrir ↗
Referência✓ VexDay Proof
CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities
CVE-2008-0546—webappsasp
Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers t
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ACG-ScriptShop - 'cid' SQL Injection
CVE-2008-4144—webappsphp
SQL injection vulnerability in index.php in ACG-ScriptShop E-Gold Script Shop allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2010-4283
CVE-2010-4283—
PHP remote file inclusion vulnerability in extras/pandora_diag.php in Pandora FMS before 3.1.1 allows remote attackers t
23RIESGO
abrir ↗
Referência
CVE-2018-1002005
CVE-2018-1002005—
These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:4
23RIESGO
abrir ↗
Referência
CVE-2014-2587
CVE-2014-2587—
SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated user
23RIESGO
abrir ↗
Referência
CVE-2014-2587
CVE-2014-2587—
SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated user
23RIESGO
abrir ↗
Referência
CVE-2017-11309
CVE-2017-11309—
Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary co
23RIESGO
abrir ↗
Referência
CVE-2017-11309
CVE-2017-11309—
Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary co
23RIESGO
abrir ↗
Referência
CVE-2009-4206
CVE-2009-4206—
SQL injection vulnerability in admin.link.modify.php in Million Dollar Text Links 1.0 and earlier allows remote attacker
23RIESGO
abrir ↗
Referência
CVE-2020-8495
CVE-2020-8495HIGH
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate se
41RIESGO
abrir ↗
Referência
CVE-2014-3848
CVE-2014-3848—
The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to o
23RIESGO
abrir ↗
Referência
CVE-2014-3848
CVE-2014-3848—
The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to o
23RIESGO
abrir ↗
Referência
CVE-2006-5521
CVE-2006-5521—
PHP remote file inclusion vulnerability in DNS/RR.php in Net_DNS 0.03 and earlier allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência
CVE-2009-4208
CVE-2009-4208—
SQL injection vulnerability in the os_news module in Open-school (OS) 1.0 allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência
CVE-2013-4865
CVE-2013-4865—
Cross-site request forgery (CSRF) vulnerability in upgrade_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! 1.5.x - 'Token' Remote Admin Change Password
CVE-2008-3681—webappsphp
components/com_user/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Anthologia 0.5.2 - 'index.php?ads_file' Remote File Inclusion
CVE-2007-2094—webappsphp
PHP remote file inclusion vulnerability in index.php in Anthologia 0.5.2 allows remote attackers to execute arbitrary PH
23RIESGO
abrir ↗
Referência
CVE-2010-2617
CVE-2010-2617—
Cross-site scripting (XSS) vulnerability in bible.php in PHP Bible Search allows remote attackers to inject arbitrary we
23RIESGO
abrir ↗
Referência✓ VexDay Proof
wbstreet 1.0 - SQL Injection / File Disclosure
CVE-2008-5956—webappsphp
Wbstreet (aka PHPSTREET Webboard) 1.0 stores sensitive information under the web root with insufficient access control,
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Generics 1.0.0 Beta - Multiple Remote File Inclusions
CVE-2007-2346—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PHP-Generics 1.0 beta allow remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Glossword 1.8.1 - 'custom_vars.php' Remote File Inclusion
CVE-2007-2743—webappsphp
PHP remote file inclusion vulnerability in custom_vars.php in GlossWord 1.8.1 allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CounterPath X-Lite 3.x - SIP phone Remote Denial of Service
CVE-2007-4382—doswindows
CounterPath X-Lite 3.0 34025, and possibly eyeBeam, allows remote attackers to cause a denial of service (device crash)
23RIESGO
abrir ↗
Referência
CVE-2012-6644
CVE-2012-6644—
Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web scr
23RIESGO
abrir ↗
Referência
CVE-2018-0715
CVE-2018-0715—
Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inje
23RIESGO
abrir ↗
Referência
CVE-2026-17530
CVE-2026-17530MEDIUM
AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization
33RIESGO
abrir ↗
Referência
CVE-2019-3474
CVE-2019-3474MEDIUM
Path traversal vulnerability in Filr web application
33RIESGO
abrir ↗
Referência
CVE-2026-17529
CVE-2026-17529MEDIUM
AstrBotDevs AstrBot astr_main_agent.py authorization
33RIESGO
abrir ↗
Referência
CVE-2016-4004
CVE-2016-4004—
Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated adminis
23RIESGO
abrir ↗
Referência
CVE-2026-5813
CVE-2026-5813MEDIUM
PHPGurukul Online Course Registration check_availability.php sql injection
33RIESGO
abrir ↗
← anteriorpágina 593 / 754siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.