Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.853exploits catalogados

39.383CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

25.447 exploits

Referência✓ VexDay Proof

TopperMod 2.0 - SQL Injection

CVE-2008-1554—webappsphp

SQL injection vulnerability in account/index.php in TopperMod 2.0, when magic_quotes_gpc is disabled, allows remote atta

23RIESGO

abrir ↗

Referência✓ VexDay Proof

SunShop Shopping Cart 4.1.4 - 'id' SQL Injection

CVE-2008-3768—webappsphp

Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow r

23RIESGO

abrir ↗

Referência

CVE-2010-0951

CVE-2010-0951—

SQL injection vulnerability in go_target.php in dev4u CMS allows remote attackers to execute arbitrary SQL commands via

23RIESGO

abrir ↗

Referência

CVE-2018-9206

CVE-2018-9206—

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

60RIESGO

abrir ↗

Referência✓ VexDay Proof

Destar 0.2.2-5 - Arbitrary Add New User

CVE-2008-6538—webappsphp

DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser.

23RIESGO

abrir ↗

Referência

CVE-2026-19756

CVE-2026-19756MEDIUM

Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal

33RIESGO

abrir ↗

Referência

CVE-2026-19753

CVE-2026-19753MEDIUM

Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery

33RIESGO

abrir ↗

Referência✓ VexDay Proof

LightNEasy sqlite / no database 1.2.2 - Multiple Vulnerabilities

CVE-2008-6593—webappsphp

SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers

23RIESGO

abrir ↗

Referência✓ VexDay Proof

MatPo Link 1.2b - Blind SQL Injection / Cross-Site Scripting

CVE-2008-6607—webappsphp

Cross-site scripting (XSS) vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to inject arbitrary

23RIESGO

abrir ↗

Referência

CVE-2019-12255

CVE-2019-12255—

Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TC

45RIESGO

abrir ↗

Referência

CVE-2021-40444

CVE-2021-40444HIGHbajo ataqueransomware

Microsoft MSHTML Remote Code Execution Vulnerability

100RIESGO

abrir ↗

Referência

CVE-2021-40444

CVE-2021-40444HIGHbajo ataqueransomware

Microsoft MSHTML Remote Code Execution Vulnerability

100RIESGO

abrir ↗

Referência

CVE-2021-40444

CVE-2021-40444HIGHbajo ataqueransomware

Microsoft MSHTML Remote Code Execution Vulnerability

100RIESGO

abrir ↗

Referência

CVE-2020-11455

CVE-2020-11455—

LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileM

60RIESGO

abrir ↗

Referência✓ VexDay Proof

WEBBDOMAIN Polls 1.01 - Authentication Bypass

CVE-2008-6625—webappsphp

SQL injection vulnerability in getin.php in WEBBDOMAIN Polls (aka Poll) 1.0 and 1.01 allows remote attackers to execute

23RIESGO

abrir ↗

Referência✓ VexDay Proof

MercuryBoard 1.1.5 - 'login.php' Blind SQL Injection

CVE-2008-6632—webappsphp

SQL injection vulnerability in func/login.php in MercuryBoard 1.1.5 and earlier allows remote attackers to execute arbit

23RIESGO

abrir ↗

Referência

CVE-2023-0297

CVE-2023-0297CRITICAL

Code Injection in pyload/pyload

85RIESGO

abrir ↗

Referência✓ VexDay Proof

Mambo Component nfnaddressbook 0.4 - Remote File Inclusion

CVE-2007-1596—webappsphp

Multiple PHP remote file inclusion vulnerabilities in the NFN Address Book (com_nfn_addressbook) 0.4 component for Mambo

23RIESGO

abrir ↗

Referência

CVE-2017-8291

CVE-2017-8291HIGHbajo ataque

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion

100RIESGO

abrir ↗

Referência✓ VexDay Proof

VideoLAN VLC Media Player 0.8.6i - Mms Protocol Handling Heap Overflow (PoC)

CVE-2008-3794—dosmultiple

Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i all

28RIESGO

abrir ↗

Referência

CVE-2023-0297

CVE-2023-0297CRITICAL

Code Injection in pyload/pyload

85RIESGO

abrir ↗

Referência

CVE-2026-19752

CVE-2026-19752MEDIUM

EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery

33RIESGO

abrir ↗

Referência✓ VexDay Proof

Shader TV (Beta) - Multiple SQL Injections

CVE-2008-6641—webappsasp

Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrar

23RIESGO

abrir ↗

Referência

CVE-2026-18973

CVE-2026-18973MEDIUM

heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-16968

CVE-2026-16968MEDIUM

GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users

33RIESGO

abrir ↗

Referência✓ VexDay Proof

U&M Software JustBookIt 1.0 - Authentication Bypass

CVE-2008-6718—webappsphp

U&M Software JustBookIt 1.0 does not require administrative authentication for all scripts in the admin/ directory, whic

23RIESGO

abrir ↗

Referência

CVE-2010-4974

CVE-2010-4974—

SQL injection vulnerability in info.php in BrotherScripts (BS) and ScriptsFeed Auto Dealer allows remote attackers to ex

23RIESGO

abrir ↗

Referência

CVE-2010-1064

CVE-2010-1064—

Erolife AjxGaleri VT stores sensitive information under the web root with insufficient access control, which allows remo

23RIESGO

abrir ↗

Referência

CVE-2026-18959

CVE-2026-18959MEDIUM

yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal

33RIESGO

abrir ↗

Referência✓ VexDay Proof

Flexphplink Pro - Arbitrary File Upload

CVE-2008-6731—webappsphp

Unrestricted file upload vulnerability in submitlink.php in FlexPHPLink Pro 0.0.7 allows remote attackers to execute arb

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.