Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
87.331exploits catalogados
40.631CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.377Exploit-DB 24.489GitHub PoC 18.131VulnCheck XDB 10.218Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.377 exploits
Referência✓ VexDay Proof
Mint Haber Sistemi 2.7 - 'duyuru.asp?id' SQL Injection
SQL injection vulnerability in duyuru.asp in MiNT Haber Sistemi 2.7 allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗Referência✓ VexDay Proof
iGaming CMS 1.3.1/1.5 - SQL Injection
SQL injection vulnerability in archive.php in iGaming 1.5, and 1.3.1 and earlier, allows remote attackers to execute arb
23RIESGO
abrir ↗Referência
CVE-2017-14089
An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated u
23RIESGO
abrir ↗Referência✓ VexDay Proof
TaskFreak! 0.6.1 - SQL Injection
SQL injection vulnerability in index.php in TaskFreak! 0.6.1 and earlier allows remote authenticated users to execute ar
23RIESGO
abrir ↗Referência
CVE-2016-1240
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia
38RIESGO
abrir ↗Referência
CVE-2011-2506
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restric
23RIESGO
abrir ↗Referência
CVE-2010-4279
The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which al
50RIESGO
abrir ↗Referência
CVE-2016-0145
The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
35RIESGO
abrir ↗Referência
CVE-2009-3249
Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary
23RIESGO
abrir ↗Referência✓ VexDay Proof
osTicket 1.12 - Formula Injection
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the ex
23RIESGO
abrir ↗Referência
CVE-2010-4279
The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which al
50RIESGO
abrir ↗Referência
CVE-2019-19516
Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a pa
23RIESGO
abrir ↗Referência
CVE-2017-3546
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChann
23RIESGO
abrir ↗Referência
CVE-2017-11346
Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors invo
35RIESGO
abrir ↗Referência
CVE-2019-19516
Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a pa
23RIESGO
abrir ↗Referência✓ VexDay Proof
Article System 0.1 - 'INCLUDE_DIR' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Article System 1.0 allow remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗Referência
CVE-2022-2840
Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi
28RIESGO
abrir ↗Referência
CVE-2012-1661
ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, wh
28RIESGO
abrir ↗Referência
CVE-2026-107128
Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization
33RIESGO
abrir ↗Referência
CVE-2026-107127
Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
41RIESGO
abrir ↗Referência
CVE-2012-1661
ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, wh
28RIESGO
abrir ↗Referência✓ VexDay Proof
FaScript FaPersian Petition - SQL Injection
SQL injection vulnerability in show.php in FaScript FaPersian Petition allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗Referência✓ VexDay Proof
FaScript FaPersianHack 1.0 - SQL Injection
SQL injection vulnerability in class/show.php in FaScript FaPersianHack 1.0 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗Referência
CVE-2010-1354
Directory traversal vulnerability in the VJDEO (com_vjdeo) component 1.0 and 1.0.1 for Joomla! allows remote attackers t
43RIESGO
abrir ↗Referência
CVE-2010-4912
SQL injection vulnerability in shop.php in UCenter Home 2.0 allows remote attackers to execute arbitrary SQL commands vi
23RIESGO
abrir ↗Referência✓ VexDay Proof
Joomla! 1.5.12 TinyMCE - Remote Code Execution (via Arbitrary File Upload)
Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.
23RIESGO
abrir ↗Referência
CVE-2012-1011
actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions
23RIESGO
abrir ↗Referência
CVE-2017-6553
Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full
50RIESGO
abrir ↗Referência
CVE-2017-15965
The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in
23RIESGO
abrir ↗Referência
CVE-2012-6050
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consu
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.