Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2015-2169
CVE-2015-2169—
Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attacker
23RIESGO
abrir ↗
Referência
CVE-2009-4541
CVE-2009-4541—
Multiple PHP remote file inclusion vulnerabilities in IsolSoft Support Center 2.5 allow remote attackers to execute arbi
23RIESGO
abrir ↗
Referência
CVE-2026-14732
CVE-2026-14732MEDIUM
SourceCodester Class and Exam Timetabling System edit_exam.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14714
CVE-2026-14714MEDIUM
zhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authentication
33RIESGO
abrir ↗
Referência✓ VexDay Proof
Oracle 10g - MDSYS.SDO_TOPO_DROP_FTBL SQL Injection (Metasploit)
CVE-2008-3979—localmultiple
Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authent
50RIESGO
abrir ↗
Referência✓ VexDay Proof
SFS EZ Gaming Directory - 'cat_id' SQL Injection
CVE-2008-6781—webappsphp
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to exec
23RIESGO
abrir ↗
Referência
CVE-2009-3503
CVE-2009-3503—
Multiple SQL injection vulnerabilities in search.aspx in BPowerHouse BPHolidayLettings 1.0 allow remote attackers to exe
23RIESGO
abrir ↗
Referência
CVE-2015-6750
CVE-2015-6750—
Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long
23RIESGO
abrir ↗
Referência
CVE-2014-3740
CVE-2014-3740—
Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbi
23RIESGO
abrir ↗
Referência
CVE-2014-3806
CVE-2014-3806—
Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows remote attack
23RIESGO
abrir ↗
Referência
CVE-2018-9233
CVE-2018-9233—
Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Vir
23RIESGO
abrir ↗
Referência
CVE-2010-0372
CVE-2010-0372—
SQL injection vulnerability in the Articlemanager (com_articlemanager) component for Joomla! allows remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2010-4774
CVE-2010-4774—
SQL injection vulnerability in pdf.php in AuraCMS 1.62 allows remote attackers to execute arbitrary SQL commands via the
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Shadowed Portal Module Character Roster - 'mod_root' Remote File Inclusion
CVE-2006-6850—webappsphp
PHP remote file inclusion vulnerability in include.php in the Roster Module (character_roster) in Shadowed Portal 5.7 al
23RIESGO
abrir ↗
Referência
CVE-2015-2432
CVE-2015-2432—
ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,
35RIESGO
abrir ↗
Referência
CVE-2024-13985
CVE-2024-13985CRITICAL
Dahua EIMS capture_handle.action RCE
68RIESGO
abrir ↗
Referência
CVE-2024-13985
CVE-2024-13985CRITICAL
Dahua EIMS capture_handle.action RCE
68RIESGO
abrir ↗
Referência
CVE-2024-13985
CVE-2024-13985CRITICAL
Dahua EIMS capture_handle.action RCE
68RIESGO
abrir ↗
Referência
CVE-2017-6984
CVE-2017-6984—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. iTun
23RIESGO
abrir ↗
Referência
CVE-2026-13210
CVE-2026-13210HIGH
Incorrect Authorization in GitLab
41RIESGO
abrir ↗
Referência
CVE-2026-94231
CVE-2026-94231MEDIUM
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification
33RIESGO
abrir ↗
Referência
CVE-2026-94230
CVE-2026-94230MEDIUM
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions
33RIESGO
abrir ↗
Referência
CVE-2013-2088
CVE-2013-2088—
contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit perm
35RIESGO
abrir ↗
Referência✓ VexDay Proof
Mambo Component SimpleBoard 1.0.3 - 'catid' SQL Injection
CVE-2008-1077—webappsphp
SQL injection vulnerability in index.php in the Simpleboard (com_simpleboard) 1.0.3 Stable component for Mambo and Jooml
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Microsoft Windows - GDI Image Parsing Stack Overflow (MS08-021)
CVE-2008-1083HIGHlocalwindows
Heap-based buffer overflow in the CreateDIBPatternBrushPt function in GDI in Microsoft Windows 2000 SP4, XP SP2, Server
53RIESGO
abrir ↗
Referência
CVE-2014-3806
CVE-2014-3806—
Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows remote attack
23RIESGO
abrir ↗
Referência
CVE-2019-17124
CVE-2019-17124—
Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.
28RIESGO
abrir ↗
Referência
CVE-2014-4874
CVE-2014-4874—
BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment
23RIESGO
abrir ↗
Referência
CVE-2020-11803
CVE-2020-11803—
An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with th
23RIESGO
abrir ↗
Referência
CVE-2017-15920
CVE-2017-15920—
In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer
23RIESGO
abrir ↗
← anteriorpágina 656 / 878siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.