Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
78.056exploits catalogados
35.925CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.640GitHub PoC 14.392VulnCheck XDB 8755Nuclei 4333Metasploit 3478✓ solo verificadosrecientespopularesriesgo
22.600 exploits
Referência
LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting
Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of t
23RIESGO
abrir ↗Referência✓ VexDay Proof
CcMail 1.0.1 - 'functions_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in functions/update.php in Cicoandcico CcMail 1.0 allows remote attackers to exe
23RIESGO
abrir ↗Referência
CVE-2014-9236
Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier al
23RIESGO
abrir ↗Referência
CVE-2018-12897
SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow.
23RIESGO
abrir ↗Referência
CVE-2009-4806
admin/save_user.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which
23RIESGO
abrir ↗Referência
CVE-2019-0881
An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows
23RIESGO
abrir ↗Referência
CVE-2026-5534
itsourcecode Online Enrollment System Parameter index.php sql injection
33RIESGO
abrir ↗Referência✓ VexDay Proof
Oxygen 2.0 - 'repquote' SQL Injection
SQL injection vulnerability in post.php in Oxygen (aka O2PHP Bulletin Board) 2.0 allows remote attackers to execute arbi
23RIESGO
abrir ↗Referência
CVE-2016-6851
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX G
23RIESGO
abrir ↗Referência
CVE-2013-2594
SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote at
23RIESGO
abrir ↗Referência
CVE-2026-5533
badlogic pi-mono SVG Artifact SvgArtifact.ts cross site scripting
33RIESGO
abrir ↗Referência✓ VexDay Proof
SlimCMS 1.0.0 - 'redirect.php' Privilege Escalation
redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative us
23RIESGO
abrir ↗Referência
CVE-2016-4108
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof
35RIESGO
abrir ↗Referência✓ VexDay Proof
RPortal 1.1 - 'file_op' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in RPortal 1.1 and earlier allows remote attackers to execute arbit
23RIESGO
abrir ↗Referência
CVE-2015-2995
The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote at
50RIESGO
abrir ↗Referência
CVE-2012-6526
SQL injection vulnerability in show_code.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbitrar
23RIESGO
abrir ↗Referência✓ VexDay Proof
BASE 1.2.4 - melissa Snort Frontend Remote File Inclusion
PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_gl
50RIESGO
abrir ↗Referência✓ VexDay Proof
CCleague Pro 1.0.1RC1 - 'cookie' Remote Code Execution
Directory traversal vulnerability in admin.php in CCleague Pro Sports CMS 1.0.1 RC1 allows remote attackers to read and
23RIESGO
abrir ↗Referência✓ VexDay Proof
GL-SH Deaf Forum 6.4.4 - Local File Inclusion
Multiple directory traversal vulnerabilities in GL-SH Deaf Forum 6.4.4 and earlier allow remote attackers to include and
23RIESGO
abrir ↗Referência✓ VexDay Proof
Scribe 0.2 - PHP Remote Code Execution
Directory traversal vulnerability in forum.php in Ben Ng Scribe 0.2 and earlier allows remote attackers to create or ove
23RIESGO
abrir ↗Referência✓ VexDay Proof
Blog PixelMotion - 'sauvBase.php' Arbitrary Database Backup
admin/sauvBase.php in Blog Pixel Motion (aka Blog PixelMotion) does not require authentication, which allows remote atta
23RIESGO
abrir ↗Referência
CVE-2026-72741
Rainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access
41RIESGO
abrir ↗Referência✓ VexDay Proof
realm CMS 2.3 - Multiple Vulnerabilities
Realm CMS 2.3 and earlier allows remote attackers to obtain sensitive information via a direct request to _db/compact.as
23RIESGO
abrir ↗Referência✓ VexDay Proof
SimpleBlog 2.0 - 'comments.asp' SQL Injection (1)
SQL injection vulnerability in comments.asp in SimpleBlog 2.0 and earlier allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗Referência
CVE-2026-19710
SourceCodester Simple Student Information System view_department.php sql injection
33RIESGO
abrir ↗Referência
CVE-2009-4675
admin/admin_info/index.php in the Mole Group Gastro Portal (Restaurant Directory) Script does not require administrative
23RIESGO
abrir ↗Referência
CVE-2026-18048
WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal
41RIESGO
abrir ↗Referência✓ VexDay Proof
Thickbox Gallery 2.0 - 'Admins.php' Admin Data Disclosure
Davlin Thickbox Gallery 2 allows remote attackers to obtain the administrative username and MD5 password hash via a dire
23RIESGO
abrir ↗Referência
CVE-2011-0886
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the SMC SMCD3G-CCR (aka Comcast Busin
23RIESGO
abrir ↗Referência✓ VexDay Proof
nightfall personal diary 1.0 - Cross-Site Scripting / File Disclosure
Nightfall Personal Diary 1.0 stores sensitive information under the web root with insufficient access control, which all
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.