Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2015-7944
CVE-2015-7944—
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Sisfo Kampus 2006 - 'blanko.preview.php' Local File Disclosure
CVE-2007-4820—webappsphp
Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitra
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP Auto Listings - 'pg' SQL Injection
CVE-2008-6226—webappsphp
SQL injection vulnerability in moreinfo.php in Pre Projects PHP Auto Listings Script, when magic_quotes_gpc is disabled,
23RIESGO
abrir ↗
Referência
CVE-2016-1879
CVE-2016-1879—
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
28RIESGO
abrir ↗
Referência
CVE-2018-1218
CVE-2018-1218—
In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the '
28RIESGO
abrir ↗
Referência
CVE-2018-4237
CVE-2018-4237—
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
43RIESGO
abrir ↗
Referência
CVE-2015-3088
CVE-2015-3088—
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows an
35RIESGO
abrir ↗
Referência
CVE-2017-10246
CVE-2017-10246—
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Suppo
28RIESGO
abrir ↗
Referência
CVE-2019-1149
CVE-2019-1149HIGH
Microsoft Graphics Remote Code Execution Vulnerability
46RIESGO
abrir ↗
Referência
CVE-2026-90687
CVE-2026-90687MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP League 0.82 - 'classement.php' SQL Injection
CVE-2006-5676—webappsasp
SQL injection vulnerability in consult/classement.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2019-3810
CVE-2019-3810MEDIUM
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported vers
38RIESGO
abrir ↗
Referência
CVE-2020-5726
CVE-2020-5726—
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A rem
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP 4.4.6 - 'crack_opendict()' Local Buffer Overflow
CVE-2007-1401—localwindows
Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allo
23RIESGO
abrir ↗
Referência
CVE-2026-90686
CVE-2026-90686MEDIUM
GPAC MP4Box loader_bt.c gf_bt_report memory corruption
33RIESGO
abrir ↗
Referência
CVE-2026-90685
CVE-2026-90685LOW
GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion
28RIESGO
abrir ↗
Referência
CVE-2013-3526
CVE-2013-3526—
Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earli
43RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP Webquest 2.5 - 'id_actividad' SQL Injection
CVE-2007-4920—webappsphp
SQL injection vulnerability in soporte_derecha_w.php in PHP Webquest 2.5 and earlier allows remote attackers to execute
23RIESGO
abrir ↗
Referência
CVE-2013-6127
CVE-2013-6127—
The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53
28RIESGO
abrir ↗
Referência
CVE-2016-1879
CVE-2016-1879—
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
28RIESGO
abrir ↗
Referência
CVE-2017-11152
CVE-2017-11152—
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 all
28RIESGO
abrir ↗
Referência✓ VexDay Proof
SFS EZ Software - 'id' SQL Injection
CVE-2008-6237—webappsphp
SQL injection vulnerability in software-description.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote at
23RIESGO
abrir ↗
Referência
CVE-2018-6383
CVE-2018-6383—
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but
28RIESGO
abrir ↗
Referência
CVE-2019-7391
CVE-2019-7391—
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
28RIESGO
abrir ↗
Referência
CVE-2019-7391
CVE-2019-7391—
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
28RIESGO
abrir ↗
Referência
CVE-2026-13556
CVE-2026-13556MEDIUM
itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2010-1352
CVE-2010-1352—
Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote
43RIESGO
abrir ↗
Referência
CVE-2026-13555
CVE-2026-13555MEDIUM
itsourcecode Online Hotel Management System controller.php add sql injection
33RIESGO
abrir ↗
Referência
CVE-2014-5465
CVE-2014-5465—
Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress
28RIESGO
abrir ↗
Referência✓ VexDay Proof
T.G.S. CMS 0.1.7 - 'logout.php' SQL Injection
CVE-2006-5732—webappsphp
SQL injection vulnerability in logout.php in T.G.S. CMS 0.1.7 and earlier allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
← anteriorpágina 630 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.