Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência✓ VexDay Proof
IntelliTamper 2.07 - '.map' Local Arbitrary Code Execution (1)
CVE-2006-2494—localwindows
Stack-based buffer overflow in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a crafted .map f
23RIESGO
abrir ↗
Referência
CVE-2026-85397
CVE-2026-85397MEDIUM
code-projects Hospital Information System addReq.php findBySearch sql injection
33RIESGO
abrir ↗
Referência
CVE-2019-6340
CVE-2019-6340HIGHbajo ataque
Drupal core - Highly critical - Remote Code Execution
100RIESGO
abrir ↗
Referência
CVE-2025-15485
CVE-2025-15485HIGH
Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call
41RIESGO
abrir ↗
Referência
CVE-2026-92466
CVE-2026-92466HIGH
microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
41RIESGO
abrir ↗
Referência
CVE-2026-92460
CVE-2026-92460HIGH
yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
41RIESGO
abrir ↗
Referência
CVE-2026-14562
CVE-2026-14562MEDIUM
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-14560
CVE-2026-14560CRITICAL
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
48RIESGO
abrir ↗
Referência
CVE-2025-15481
CVE-2025-15481MEDIUM
Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-14559
CVE-2026-14559CRITICAL
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover
48RIESGO
abrir ↗
Referência
CVE-2024-3773
CVE-2024-3773MEDIUM
LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode
33RIESGO
abrir ↗
Referência
CVE-2019-8923
CVE-2019-8923—
XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discont
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Surgemail 38k - 'Search' Remote Buffer Overflow
CVE-2007-4377—remotewindows
Stack-based buffer overflow in the IMAP service in SurgeMail 38k allows remote authenticated users to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2017-5715
CVE-2017-5715MEDIUM
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl
55RIESGO
abrir ↗
Referência
CVE-2019-8926
CVE-2019-8926—
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zon
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Foro Domus 2.10 - 'phpbb_root_path' Remote File Inclusion
CVE-2007-0580—webappsphp
PHP remote file inclusion vulnerability in menu.php in Foro Domus 2.10 allows remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗
Referência
CVE-2026-12664
CVE-2026-12664MEDIUM
Incorrect Authorization in GitLab
33RIESGO
abrir ↗
Referência
CVE-2026-16569
CVE-2026-16569MEDIUM
ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update
33RIESGO
abrir ↗
Referência
CVE-2020-0618
CVE-2020-0618CRITICALbajo ataqueransomware
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page
100RIESGO
abrir ↗
Referência
Joomla! Component JEXTN Reverse Auction 3.1.0 - SQL Injection
CVE-2018-6579—webappsphp
SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Epistemon 1.0 - 'common.php?inc_path' Remote File Inclusion
CVE-2007-0701—webappsphp
PHP remote file inclusion vulnerability in inc/common.inc.php in Epistemon 1.0 allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Somery 0.4.6 - 'skin_dir' Remote File Inclusion
CVE-2007-0704—webappsphp
PHP remote file inclusion vulnerability in install.php in Somery 0.4.6 allows remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗
Referência
CVE-2026-15381
CVE-2026-15381LOW
WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter
28RIESGO
abrir ↗
Referência
CVE-2020-0618
CVE-2020-0618CRITICALbajo ataqueransomware
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page
100RIESGO
abrir ↗
Referência
CVE-2026-81934
CVE-2026-81934HIGH
Redis TLS pending-data list use-after-free
41RIESGO
abrir ↗
Referência
CVE-2026-13392
CVE-2026-13392HIGH
ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)
41RIESGO
abrir ↗
Referência✓ VexDay Proof
DL PayCart 1.01 - 'viewitem.php?ItemID' Blind SQL Injection
CVE-2007-4604—webappsphp
SQL injection vulnerability in viewitem.php in DL PayCart 1.01 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPNuke-Clan 4.2.0 - 'mvcw_conver.php' Remote File Inclusion
CVE-2007-4606—webappsphp
PHP remote file inclusion vulnerability in convert/mvcw_conver.php in the Virtual War (VWar) module for PHPNuke-Clan (PN
23RIESGO
abrir ↗
Referência
CVE-2026-82696
CVE-2026-82696MEDIUM
itsourcecode Sales and Inventory System inv_searchfrm.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-16568
CVE-2026-16568MEDIUM
ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR
33RIESGO
abrir ↗
← anteriorpágina 610 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.