Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência✓ VexDay Proof
cattaDoc 2.21 - 'download2.php?fn1' Remote File Disclosure
Directory traversal vulnerability in download2.php in cattaDoc 2.21, and possibly other versions including 3.0, allows r
23RIESGO
abrir ↗Referência
CVE-2009-4758
Stack-based buffer overflow in dicas Mpegable Player 2.12 allows remote attackers to cause a denial of service (applicat
23RIESGO
abrir ↗Referência
CVE-2010-1054
Multiple SQL injection vulnerabilities in ParsCMS allow remote attackers to execute arbitrary SQL commands via the RP pa
23RIESGO
abrir ↗Referência
CVE-2026-108641
JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne
33RIESGO
abrir ↗Referência
CVE-2026-86210
SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection
33RIESGO
abrir ↗Referência
CVE-2016-6186
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/j
23RIESGO
abrir ↗Referência✓ VexDay Proof
BP Blog 6.0 - 'id' Blind SQL Injection
Multiple SQL injection vulnerabilities in BP Blog 6.0 allow remote attackers to execute arbitrary SQL commands via the (
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHP-Address Book 3.1.5 - SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to inje
23RIESGO
abrir ↗Referência
CVE-2014-8391
The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to o
23RIESGO
abrir ↗Referência
CVE-2017-18016
Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
23RIESGO
abrir ↗Referência
CVE-2015-8285
The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
23RIESGO
abrir ↗Referência
CVE-2010-5280
Directory traversal vulnerability in the Community Builder Enhanced (CBE) (com_cbe) component 1.4.8, 1.4.9, and 1.4.10 f
23RIESGO
abrir ↗Referência
CVE-2016-1743
The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary co
23RIESGO
abrir ↗Referência
CVE-2017-15221
ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file, a related issue to CVE-2009-1324.
23RIESGO
abrir ↗Referência
CVE-2026-89236
SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters
41RIESGO
abrir ↗Referência
CVE-2026-16578
Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route
41RIESGO
abrir ↗Referência
CVE-2026-80518
WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path
28RIESGO
abrir ↗Referência
CVE-2026-16281
Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR
41RIESGO
abrir ↗Referência
CVE-2017-15221
ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file, a related issue to CVE-2009-1324.
23RIESGO
abrir ↗Referência✓ VexDay Proof
Really Simple PHP and Ajax (RSPA) 2007-03-23 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Really Simple PHP and Ajax (RSPA) 2007-03-23 and earlier allow rem
23RIESGO
abrir ↗Referência
CVE-2010-5280
Directory traversal vulnerability in the Community Builder Enhanced (CBE) (com_cbe) component 1.4.8, 1.4.9, and 1.4.10 f
23RIESGO
abrir ↗Referência✓ VexDay Proof
Yahoo! Music Jukebox 2.2 - 'AddImage()' ActiveX Remote Buffer Overflow (PoC)
Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows
23RIESGO
abrir ↗Referência✓ VexDay Proof
CMS MAXSITE 1.10 - 'category' SQL Injection
SQL injection vulnerability in index.php in MAXSITE 1.10 and earlier allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗Referência✓ VexDay Proof
Flux CMS 1.5.0 - 'loadsave.php' Arbitrary File Overwrite
webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overw
23RIESGO
abrir ↗Referência
CVE-2010-1495
Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to rea
43RIESGO
abrir ↗Referência
CVE-2010-0632
SQL injection vulnerability in the Parkview Consultants SimpleFAQ (com_simplefaq) component for Joomla! allows remote at
23RIESGO
abrir ↗Referência
CVE-2014-0866
RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics sends cleartext c
23RIESGO
abrir ↗Referência
CVE-2014-8391
The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to o
23RIESGO
abrir ↗Referência
CVE-2003-1160
FlexWATCH Network video server 132 allows remote attackers to bypass authentication and gain administrative privileges v
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.