Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2026-103229
CVE-2026-103229MEDIUM
AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-108678
CVE-2026-108678MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles
33RIESGO
abrir ↗
Referência
CVE-2026-108623
CVE-2026-108623HIGH
JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch
41RIESGO
abrir ↗
Referência
CVE-2026-104651
CVE-2026-104651MEDIUM
Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
33RIESGO
abrir ↗
Referência
CVE-2013-20009
CVE-2013-20009MEDIUM
Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-116471
CVE-2026-116471MEDIUM
BKWLD Decoy Authorization Policy Policy.php privileges management
33RIESGO
abrir ↗
Referência
CVE-2026-116461
CVE-2026-116461MEDIUM
Omega Solution Restro POS sale-invoice logic error
33RIESGO
abrir ↗
Referência
CVE-2026-116385
CVE-2026-116385MEDIUM
Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-116370
CVE-2026-116370MEDIUM
2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion
33RIESGO
abrir ↗
Referência
CVE-2026-110691
CVE-2026-110691MEDIUM
WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update
33RIESGO
abrir ↗
Referência
CVE-2026-106002
CVE-2026-106002MEDIUM
Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion
33RIESGO
abrir ↗
Referência
CVE-2026-105997
CVE-2026-105997MEDIUM
Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient
33RIESGO
abrir ↗
Referência
CVE-2026-116384
CVE-2026-116384MEDIUM
Bdtask Garage 24 Garage Management Software Backend improper authorization
33RIESGO
abrir ↗
Referência
CVE-2010-20125
CVE-2010-20125HIGH
DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php
41RIESGO
abrir ↗
Referência
CVE-2026-117572
CVE-2026-117572MEDIUM
WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-117571
CVE-2026-117571HIGH
WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
41RIESGO
abrir ↗
Referência
CVE-2026-117509
CVE-2026-117509MEDIUM
crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal
33RIESGO
abrir ↗
Referência
CVE-2024-10914
CVE-2024-10914CRITICAL
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RIESGO
abrir ↗
Referência✓ VexDay Proof
BitchX 1.1-final - 'EXEC' Remote Command Execution
CVE-2007-3360—remotelinux
hook.c in BitchX 1.1-final allows remote IRC servers to execute arbitrary commands by sending a client certain data cont
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TurnkeyForms Local Classifieds - Cross-Site Scripting / SQL Injection
CVE-2008-6350—webappsphp
SQL injection vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MPlayer 1.0 rc2 - 'sdpplin_parse()' Array Indexing Buffer Overflow (PoC)
CVE-2008-1558—doslinux
Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote att
28RIESGO
abrir ↗
Referência✓ VexDay Proof
IBiz E-Banking Integrator 2.0 - ActiveX Edition Insecure Method
CVE-2008-1725—remotewindows
The IBizEBank.FIProfile.1 ActiveX control in fiprofile20.ocx in IBiz E-Banking Integrator (formerly IBiz OFX Integrator)
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MindDezign Photo Gallery 2.2 - Arbitrary Add Admin
CVE-2008-6790—webappsphp
The admin module in MindDezign Photo Gallery 2.2 allows remote attackers to add administrative users and gain privileges
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PumpKIN TFTP Server 2.7.2.0 - Denial of Service (Metasploit)
CVE-2008-6791—doswindows
PumpKIN TFTP Server 2.7.2.0 allows remote attackers to cause a denial of service via a write request with a long mode fi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component com_Eventing 1.6.x - Blind SQL Injection
CVE-2009-0421—webappsphp
SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execut
23RIESGO
abrir ↗
Referência✓ VexDay Proof
DMXReady Member Directory Manager 1.1 - SQL Injection
CVE-2009-0427—webappsasp
SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Member Directory Manager 1.1 and ea
23RIESGO
abrir ↗
Referência✓ VexDay Proof
AJA Portal 1.2 (Windows) - Local File Inclusion
CVE-2009-0457—webappsphp
Multiple directory traversal vulnerabilities in AJA Portal 1.2 allow remote attackers to include and execute arbitrary l
23RIESGO
abrir ↗
Referência✓ VexDay Proof
groone glinks 2.1 - Remote File Inclusion
CVE-2009-0463—webappsphp
PHP remote file inclusion vulnerability in includes/header.php in Groone GLinks 2.1 allows remote attackers to execute a
23RIESGO
abrir ↗
Referência
CVE-2011-4812
CVE-2011-4812—
Cross-site scripting (XSS) vulnerability in nowosci.php in BestShopPro allows remote attackers to inject arbitrary web s
23RIESGO
abrir ↗
Referência
CVE-2018-1335
CVE-2018-1335—
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to
60RIESGO
abrir ↗
← anteriorpágina 614 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.