Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-16056
CVE-2026-16056MEDIUM
Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPUserBase 1.3b - 'unverified.inc.php' Remote File Inclusion
CVE-2008-1043—webappsphp
PHP remote file inclusion vulnerability in templates/default/header.inc.php in Linux Web Shop (LWS) php User Base 1.3 BE
35RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component FacileForms 1.4.4 - Remote File Inclusion
CVE-2008-2990—webappsphp
PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) component 1.4.4 fo
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Downline Goldmine paidversion - SQL Injection
CVE-2008-4178—webappsphp
SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and D
23RIESGO
abrir ↗
Referência
CVE-2012-0911
CVE-2012-0911—
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted
50RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP Realtor 1.5 - 'v_cat' SQL Injection
CVE-2008-4496—webappsphp
SQL injection vulnerability in view_cat.php in PHP Realtor 1.5 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2009-2335
CVE-2009-2335—
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the u
60RIESGO
abrir ↗
Referência
CVE-2018-17463
CVE-2018-17463HIGHbajo ataque
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbit
100RIESGO
abrir ↗
Referência
CVE-2019-1620
CVE-2019-1620CRITICAL
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RIESGO
abrir ↗
Referência
CVE-2015-3035
CVE-2015-3035HIGHbajo ataque
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before
100RIESGO
abrir ↗
Referência
CVE-2023-25690
CVE-2023-25690CRITICAL
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
70RIESGO
abrir ↗
Referência
rConfig 3.9.4 - 'search.crud.php' Remote Command Injection
CVE-2020-10879—webappsphp
rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nod
45RIESGO
abrir ↗
Referência
CVE-2008-1122
CVE-2008-1122—
SQL injection vulnerability in the downloads module in Koobi Pro 5.7 allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Kasseler CMS 1.3.0 - Local File Inclusion / Cross-Site Scripting
CVE-2008-3088—webappsphp
Cross-site scripting (XSS) vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attacker
23RIESGO
abrir ↗
Referência✓ VexDay Proof
LoudBlog 0.8.0a - 'ajax.php' SQL Injection
CVE-2008-6077—webappsphp
SQL injection vulnerability in loudblog/ajax.php in LoudBlog 0.8.0a and earlier allows remote authenticated users to exe
23RIESGO
abrir ↗
Referência
CVE-2009-2265
CVE-2009-2265—
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable fil
60RIESGO
abrir ↗
Referência
CVE-2009-3309
CVE-2009-3309—
SQL injection vulnerability in index.cfm in CF ShopKart 5.4 beta allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2017-17587
CVE-2017-17587—
FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or c
23RIESGO
abrir ↗
Referência✓ VexDay Proof
QuickTalk Forum 1.6 - Blind SQL Injection
CVE-2008-1316—webappsphp
SQL injection vulnerability in qtf_ind_search_ov.php in QT-cute QuickTalk Forum 1.6 and earlier allows remote attackers
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload
CVE-2008-4493—remotewindows
Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Editio
28RIESGO
abrir ↗
Referência
CVE-2008-1336
CVE-2008-1336—
SQL injection vulnerability in Koobi CMS 4.2.3 through 4.3.0 allows remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗
Referência
jira 4.4.3 / greenhopper < 5.9.8 - Multiple Vulnerabilities
CVE-2012-1500—webappsjsp
Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject
23RIESGO
abrir ↗
Referência
CVE-2017-11317
CVE-2017-11317CRITICALbajo ataque
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Built2Go PHP Realestate 1.5 - 'event_detail.php' SQL Injection
CVE-2008-4497—webappsphp
SQL injection vulnerability in event_detail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ITLPoll 2.7 Stable2 - Blind SQL Injection
CVE-2009-0295—webappsphp
SQL injection vulnerability in index.php in Information Technology Light Poll Information (ITLPoll) 2.7 Stable 2, when m
23RIESGO
abrir ↗
Referência
CVE-2009-3539
CVE-2009-3539—
Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Ultra Classifieds Pro allow remote attackers to inj
23RIESGO
abrir ↗
Referência
CVE-2012-1261
CVE-2012-1261—
Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow
23RIESGO
abrir ↗
Referência
CVE-2012-1261
CVE-2012-1261—
Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow
23RIESGO
abrir ↗
Referência
CVE-2012-1503
CVE-2012-1503—
Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote a
23RIESGO
abrir ↗
Referência
CVE-2019-2729
CVE-2019-2729CRITICAL
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
85RIESGO
abrir ↗
← anteriorpágina 613 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.