Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.056exploits catalogados
35.925CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.640GitHub PoC 14.392VulnCheck XDB 8755Nuclei 4333Metasploit 3478✓ solo verificadosrecientespopularesriesgo
22.600 exploits
Referência
CVE-2012-6608
CVE-2012-6608—
Cross-site scripting (XSS) vulnerability in xmlservices/E_book.php in Elastix 2.3.0 allows remote attackers to inject ar
23RIESGO
abrir ↗
Referência
CVE-2006-5190
CVE-2006-5190—
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Mozilla Firefox 3.0.5 - Status Bar Obfuscation / Clickjacking
CVE-2009-0253—remotewindows
Mozilla Firefox 3.0.5 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that
23RIESGO
abrir ↗
Referência
CVE-2009-4604
CVE-2009-4604—
PHP remote file inclusion vulnerability in mamboleto.php in the Fernando Soares Mamboleto (com_mamboleto) component 2.0
23RIESGO
abrir ↗
Referência
CVE-2009-4604
CVE-2009-4604—
PHP remote file inclusion vulnerability in mamboleto.php in the Fernando Soares Mamboleto (com_mamboleto) component 2.0
23RIESGO
abrir ↗
Referência
CVE-2023-32315
CVE-2023-32315HIGHbajo ataque
Openfire administration console authentication bypass
100RIESGO
abrir ↗
Referência
CVE-2024-3273
CVE-2024-3273HIGHbajo ataque
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
100RIESGO
abrir ↗
Referência
CVE-2011-2523
CVE-2011-2523—
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RIESGO
abrir ↗
Referência★ 64
FortiWeb CVE-2025-25257 exploit
CVE-2025-25257CRITICALbajo ataque
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RIESGO
abrir ↗
Referência
FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution
CVE-2025-25257CRITICALbajo ataquewebappsmultiple
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Multiple Vendor - PF Null Pointer Dereference
CVE-2009-0687—dosbsd
The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirO
23RIESGO
abrir ↗
Referência✓ VexDay Proof
OpenBSD 4.5 - IP datagrams Remote Denial of Service
CVE-2009-0687—dosopenbsd
The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirO
23RIESGO
abrir ↗
Referência
CVE-2026-8214
CVE-2026-8214MEDIUM
Industrial Application Software IAS Canias ERP RMI doAction improper authentication
33RIESGO
abrir ↗
Referência
CVE-2013-2294
CVE-2013-2294—
Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbi
23RIESGO
abrir ↗
Referência
CVE-2013-2423
CVE-2013-2423LOWbajo ataque
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
95RIESGO
abrir ↗
Referência
CVE-2014-9258
CVE-2014-9258—
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to exec
23RIESGO
abrir ↗
Referência
CVE-2023-46805
CVE-2023-46805HIGHbajo ataqueransomware
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a re
100RIESGO
abrir ↗
Referência
CVE-2023-22527
CVE-2023-22527CRITICALbajo ataqueransomware
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta
100RIESGO
abrir ↗
Referência
CVE-2026-10062
CVE-2026-10062HIGH
TRENDnet TEW-432BRP formSetRoute stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2013-2684
CVE-2013-2684—
Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web
23RIESGO
abrir ↗
Referência
CVE-2009-4721
CVE-2009-4721—
Multiple SQL injection vulnerabilities in Admin/index.asp in Andrews-Web (A-W) BannerAd 1.0 allow remote attackers to ex
23RIESGO
abrir ↗
Referência
CVE-2015-0313
CVE-2015-0313HIGHbajo ataque
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
100RIESGO
abrir ↗
Referência
CVE-2013-3529
CVE-2013-3529—
Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress plugin before 1.1.7 for Wor
23RIESGO
abrir ↗
Referência
CVE-2013-3532
CVE-2013-3532—
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote
23RIESGO
abrir ↗
Referência
CVE-2013-3532
CVE-2013-3532—
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote
23RIESGO
abrir ↗
Referência
CVE-2013-3537
CVE-2013-3537—
Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2026-9627
CVE-2026-9627HIGH
UTT HiPER 1200GW Web Management setSysAdm strcpy buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2025-8730
CVE-2025-8730CRITICAL
Belkin F9K1009/F9K1010 Web Interface hard-coded credentials
48RIESGO
abrir ↗
Referência✓ VexDay Proof
Zervit Web Server 0.02 - Remote Buffer Overflow (PoC)
CVE-2009-1353—doswindows
Buffer overflow in the http_parse_hex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Elecard AVC HD Player - '.XPL' Stack Buffer Overflow (SEH) (PoC)
CVE-2009-1356—doswindows
Stack-based buffer overflow in Elecard AVC HD Player allows remote attackers to execute arbitrary code via a long MP3 fi
23RIESGO
abrir ↗
← anteriorpágina 606 / 754siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.