Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.168exploits catalogados
40.553CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.327Exploit-DB 24.488GitHub PoC 18.080VulnCheck XDB 10.169Nuclei 4567Metasploit 3537✓ solo verificadosrecientespopularesriesgo
26.327 exploits
Referência
CVE-2009-0886
Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read
23RIESGO
abrir ↗Referência
CVE-2010-3142
Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attacker
28RIESGO
abrir ↗Referência
CVE-2011-5165
Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem
50RIESGO
abrir ↗Referência✓ VexDay Proof
PHPKB Knowledge Base Software 1.5 - 'ID' SQL Injection
SQL injection vulnerability in comment.php in PHP Knowledge Base (PHPKB) 1.5 and 2.0 allows remote attackers to execute
23RIESGO
abrir ↗Referência✓ VexDay Proof
Silentum LoginSys 1.0.0 - Insecure Cookie Handling
login2.php in Silentum LoginSys 1.0.0 allows remote attackers to bypass authentication and obtain access to an arbitrary
23RIESGO
abrir ↗Referência
CVE-2008-7053
LogMeIn Remote Access Utility ActiveX control (RACtrl.dll) allows remote attackers to cause a denial of service (crash)
23RIESGO
abrir ↗Referência
CVE-2013-5673
SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attack
23RIESGO
abrir ↗Referência
CVE-2018-12589
Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in
28RIESGO
abrir ↗Referência
CVE-2016-3717
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
28RIESGO
abrir ↗Referência
CVE-2017-5227
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
23RIESGO
abrir ↗Referência
CVE-2018-12589
Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in
28RIESGO
abrir ↗Referência
CVE-2023-4113
PHP Jabbers Service Booking Script index.php cross site scripting
48RIESGO
abrir ↗Referência
CVE-2019-12137
Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substr
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHPAddressBook 2.11 - 'view.php' SQL Injection
SQL injection vulnerability in view.php in CoronaMatrix phpAddressBook 2.11 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗Referência
CVE-2026-109828
libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable
33RIESGO
abrir ↗Referência
CVE-2010-5015
SQL injection vulnerability in view_photo.php in 2daybiz Network Community Script allows remote attackers to execute arb
23RIESGO
abrir ↗Referência✓ VexDay Proof
PhotoPost vBGallery 2.4.2 - Arbitrary File Upload
Unrestricted file upload vulnerability in upload.php in PhotoPost vBGallery 2.4.2 allows remote authenticated users to e
23RIESGO
abrir ↗Referência
CVE-2009-3272
Stack consumption vulnerability in WebKit.dll in WebKit in Apple Safari 3.2.3, and possibly other versions before 4.1.2,
23RIESGO
abrir ↗Referência
CVE-2009-3318
Directory traversal vulnerability in the Roland Breedveld Album (com_album) component 1.14 for Joomla! allows remote att
38RIESGO
abrir ↗Referência
CVE-2018-5688
ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in
23RIESGO
abrir ↗Referência✓ VexDay Proof
phpChess Community Edition 2.0 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in phpChess Community Edition 2.0 allow remote attackers to execute a
23RIESGO
abrir ↗Referência
CVE-2015-0555
Buffer overflow in the XnsSdkDeviceIpInstaller.ocx ActiveX control in Samsung iPOLiS Device Manager 1.12.2 allows remote
23RIESGO
abrir ↗Referência
CVE-2019-8391
qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.
23RIESGO
abrir ↗Referência
CVE-2017-13156
An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0,
43RIESGO
abrir ↗Referência
CVE-2019-15811
In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.
38RIESGO
abrir ↗Referência
CVE-2025-15501
Sangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection
48RIESGO
abrir ↗Referência
CVE-2001-0198
Buffer overflow in QuickTime Player plugin 4.1.2 (Japanese) allows remote attackers to execute arbitrary commands via a
23RIESGO
abrir ↗Referência✓ VexDay Proof
BtiTracker 1.4.1 - Become Admin SQL Injection
Multiple SQL injection vulnerabilities in account_change.php in BtiTracker 1.4.1 and earlier allow remote attackers to e
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.