Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
85.039exploits catalogados
39.796CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.790Exploit-DB 24.487GitHub PoC 16.910VulnCheck XDB 9820Nuclei 4504Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.790 exploits
Referência
CVE-2016-1593
Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remot
50RIESGO
abrir ↗Referência
CVE-2017-11861
Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker t
35RIESGO
abrir ↗Referência
CVE-2018-8735
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut
50RIESGO
abrir ↗Referência
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via l
98RIESGO
abrir ↗Referência
CVE-2023-34039
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key g
75RIESGO
abrir ↗Referência
CVE-2023-34039
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key g
75RIESGO
abrir ↗Referência
CVE-2026-7060
liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection
33RIESGO
abrir ↗Referência
CVE-2018-8735
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut
50RIESGO
abrir ↗Referência✓ VexDay Proof
w3blabor CMS 3.3.0 - Authentication Bypass
SQL injection vulnerability in admin/index.php in w3b>cms (aka w3blabor CMS) before 3.4.0, when magic_quotes_gpc is disa
23RIESGO
abrir ↗Referência
CVE-2009-3175
Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script)
23RIESGO
abrir ↗Referência
CVE-2010-5004
SQL injection vulnerability in searchvote.php in 2daybiz Polls (aka Advanced Poll) Script allows remote attackers to exe
23RIESGO
abrir ↗Referência
CVE-2010-5009
SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHP infoBoard 7 - Plus Insecure Cookie Handling
PHP infoBoard V.7 Plus allows remote attackers to bypass authentication and gain administrative access by setting the in
23RIESGO
abrir ↗Referência
CVE-2010-5010
Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers t
23RIESGO
abrir ↗Referência
CVE-2010-5010
Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers t
23RIESGO
abrir ↗Referência
CVE-2018-9948
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader
50RIESGO
abrir ↗Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate Premium allow remote attackers to inject arbitrary w
23RIESGO
abrir ↗Referência
CVE-2018-19459
Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.
23RIESGO
abrir ↗Referência✓ VexDay Proof
SmartSite CMS 1.0 - 'root' Remote File Inclusion
PHP remote file inclusion vulnerability in include/inc_foot.php in SmartSiteCMS 1.0 and earlier allows remote attackers
23RIESGO
abrir ↗Referência✓ VexDay Proof
VMware Inc 6.0.0 - 'vielib.dll 2.2.5.42958' Remode Code Execution
Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll 2.2.5.42958 in EMC VMware 6.0.0 allows
28RIESGO
abrir ↗Referência✓ VexDay Proof
Adobe Acrobat Reader - JBIG2 Local Buffer Overflow (PoC) (2)
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitra
60RIESGO
abrir ↗Referência
CVE-2017-11165
dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a d
50RIESGO
abrir ↗Referência
CVE-2019-14287
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and se
35RIESGO
abrir ↗Referência
CVE-2026-108701
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort
33RIESGO
abrir ↗Referência
CVE-2026-108722
open-computer-use through commit 610bac8 Stored XSS via log.html Session Log
28RIESGO
abrir ↗Referência
CVE-2026-108680
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement
33RIESGO
abrir ↗Referência
CVE-2010-5011
SQL injection vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to execute arb
23RIESGO
abrir ↗Referência
CVE-2010-5012
SQL injection vulnerability in new.php in DaLogin 2.2 and 2.2.5 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗Referência
CVE-2006-6199
Stack-based buffer overflow in BlazeVideo BlazeDVD Standard and Professional 5.0, and possibly earlier, allows remote at
50RIESGO
abrir ↗Referência✓ VexDay Proof
Atomic Photo Album 1.1.0pre4 - Cross-Site Scripting / SQL Injection
Cross-site scripting (XSS) vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to i
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.