Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2010-5014
CVE-2010-5014—
SQL injection vulnerability in standings.php in Elite Gaming Ladders 3.5 allows remote attackers to execute arbitrary SQ
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Sabros.us 1.75 - 'thumbnails.php' Remote File Disclosure
CVE-2008-1799—webappsphp
Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files vi
23RIESGO
abrir ↗
Referência
CVE-2016-10079
CVE-2016-10079—
SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long
23RIESGO
abrir ↗
Referência
CVE-2013-2682
CVE-2013-2682—
Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain
23RIESGO
abrir ↗
Referência
CVE-2014-9208
CVE-2014-9208—
Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attacker
23RIESGO
abrir ↗
Referência
CVE-2026-109116
CVE-2026-109116MEDIUM
AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization
33RIESGO
abrir ↗
Referência
CVE-2018-7466
CVE-2018-7466—
install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging c
23RIESGO
abrir ↗
Referência
CVE-2016-4273
CVE-2016-4273—
Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637
28RIESGO
abrir ↗
Referência
CVE-2018-7466
CVE-2018-7466—
install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging c
23RIESGO
abrir ↗
Referência
CVE-2019-8391
CVE-2019-8391—
qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.
23RIESGO
abrir ↗
Referência
CVE-2020-27423
CVE-2020-27423—
Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial o
23RIESGO
abrir ↗
Referência
CVE-2023-4119
CVE-2023-4119MEDIUM
Academy LMS courses cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
DigiAffiliate 1.4 - 'id' SQL Injection
CVE-2007-0306—webappsasp
SQL injection vulnerability in visu_user.asp in Digiappz DigiAffiliate 1.4 and earlier allows remote attackers to execut
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MapLab MS4W 2.2.1 - Remote File Inclusion
CVE-2007-1843—webappsphp
PHP remote file inclusion vulnerability in gmapfactory/params.php in MapLab 2.2.1, when register_globals is enabled, all
23RIESGO
abrir ↗
Referência
CVE-2010-5023
CVE-2010-5023—
SQL injection vulnerability in index.asp in Digital Interchange Calendar 5.8.5 allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2012-0025
CVE-2012-0025—
Double free vulnerability in the Free_All_Memory function in jpeg/dectile.c in libfpx before 1.3.1-1, as used in the Fla
23RIESGO
abrir ↗
Referência
CVE-2013-1463
CVE-2013-1463—
Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MySpace Content Zone 3.x - Arbitrary File Upload
CVE-2007-6668—webappsphp
admin/uploadgames.php in MySpace Content Zone (MCZ) 3.x does not require administrative privileges, which allows remote
23RIESGO
abrir ↗
Referência✓ VexDay Proof
LokiCMS 0.3.3 - Remote Command Execution
CVE-2008-1860—webappsphp
Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ExBB 0.22 - Local/Remote File Inclusion
CVE-2008-1861—webappsphp
Directory traversal vulnerability in modules/threadstop/threadstop.php in ExBB Italia 0.22 and earlier, when register_gl
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ReVou Twitter Clone - Admin Password Change
CVE-2008-6752—webappsphp
adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original passw
23RIESGO
abrir ↗
Referência✓ VexDay Proof
mxCamArchive 2.2 - Bypass Configuration Download
CVE-2008-6955—webappsphp
mxCamArchive 2.2 stores sensitive information under the web root with insufficient access control, which allows remote a
23RIESGO
abrir ↗
Referência
CVE-2009-3500
CVE-2009-3500—
Multiple SQL injection vulnerabilities in BPowerHouse BPGames 1.0 allow remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2026-108971
CVE-2026-108971CRITICAL
D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification
48RIESGO
abrir ↗
Referência✓ VexDay Proof
JGBBS 3.0beta1 - 'search.asp?author' SQL Injection
CVE-2007-1440—webappsasp
SQL injection vulnerability in search.asp in JGBBS 3.0 Beta 1 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Rayzz Script 2.0 - Local/Remote File Inclusion
CVE-2007-6230—webappsphp
Directory traversal vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attack
23RIESGO
abrir ↗
Referência
CVE-2015-1480
CVE-2015-1480—
ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive tic
23RIESGO
abrir ↗
Referência
CVE-2023-4173
CVE-2023-4173LOW
mooSocial mooStore index cross site scripting
43RIESGO
abrir ↗
Referência
CVE-2009-4451
CVE-2009-4451—
Unrestricted file upload vulnerability in upper.php in kandalf upper 0.1 allows remote attackers to execute arbitrary co
23RIESGO
abrir ↗
Referência
CVE-2026-108970
CVE-2026-108970MEDIUM
itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection
33RIESGO
abrir ↗
← anteriorpágina 645 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.