Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.039exploits catalogados

39.796CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.790Exploit-DB 24.487GitHub PoC 16.910VulnCheck XDB 9820Nuclei 4504Metasploit 3528✓ solo verificadosrecientes populares riesgo

25.790 exploits

Referência

CVE-2019-17662

CVE-2019-17662—

ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exi

60RIESGO

abrir ↗

Referência

CVE-2019-5485

CVE-2019-5485—

NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be inje

35RIESGO

abrir ↗

Referência✓ VexDay Proof

CuteNews aj-fork 167f - 'cutepath' Remote File Inclusion

CVE-2006-6546—webappsphp

PHP remote file inclusion vulnerability in inc/shows.inc.php in cutenews aj-fork (CN:AJ) 167f and earlier allows remote

23RIESGO

abrir ↗

Referência

CVE-2014-10021

CVE-2014-10021—

Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote

50RIESGO

abrir ↗

Referência

CVE-2017-11841

CVE-2017-11841—

ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, versio

35RIESGO

abrir ↗

Referência

CVE-2011-0257

CVE-2011-0257—

Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a deni

50RIESGO

abrir ↗

Referência

CVE-2015-1172

CVE-2015-1172—

Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 a

50RIESGO

abrir ↗

Referência

CVE-2016-9796

CVE-2016-9796—

Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP pro

28RIESGO

abrir ↗

Referência

CVE-2017-16249

CVE-2017-16249—

The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST requ

50RIESGO

abrir ↗

Referência

CVE-2018-0707

CVE-2018-0707—

Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could

50RIESGO

abrir ↗

Referência

CVE-2018-7314

CVE-2018-7314—

SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerabil

50RIESGO

abrir ↗

Referência

CVE-2022-2143

CVE-2022-2143CRITICAL

Advantech iView

75RIESGO

abrir ↗

Referência✓ VexDay Proof

phpBookingCalendar 1.0c - 'details_view.php' SQL Injection

CVE-2006-1422—webappsphp

SQL injection vulnerability in details_view.php in PHP Booking Calendar 1.0c and earlier allows remote attackers to exec

23RIESGO

abrir ↗

Referência✓ VexDay Proof

SunOS Release 5.11 snv_101b - Remote IPv6 Crash

CVE-2009-0304—dossolaris

The kernel in Sun Solaris 10 and 11 snv_101b, and OpenSolaris before snv_108, allows remote attackers to cause a denial

23RIESGO

abrir ↗

Referência

CVE-2017-16249

CVE-2017-16249—

The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST requ

50RIESGO

abrir ↗

Referência

CVE-2018-0707

CVE-2018-0707—

Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could

50RIESGO

abrir ↗

Referência✓ VexDay Proof

MKPortal NoBoard Module (Beta) - Remote File Inclusion

CVE-2007-3813—webappsphp

PHP remote file inclusion vulnerability in include/user.php in the NoBoard BETA module for MKPortal allows remote attack

35RIESGO

abrir ↗

Referência

CVE-2009-3246

CVE-2009-3246—

SQL injection vulnerability in spnews.php in MyBuxScript PTC-BUX allows remote attackers to execute arbitrary SQL comman

23RIESGO

abrir ↗

Referência

CVE-2011-0515

CVE-2011-0515—

KisKrnl.sys 2011.1.13.89 and earlier in Kingsoft AntiVirus 2011 SP5.2 allows local users to cause a denial of service (c

23RIESGO

abrir ↗

Referência✓ VexDay Proof

PHP-Fusion Mod recept - 'kat_id' SQL Injection

CVE-2008-4527—webappsphp

SQL injection vulnerability in recept.php in the Recepies (Recept) module 1.1 for PHP-Fusion allows remote attackers to

23RIESGO

abrir ↗

Referência

CVE-2017-17562

CVE-2017-17562HIGHbajo ataque

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T

100RIESGO

abrir ↗

Referência

CVE-2015-1503

CVE-2015-1503—

Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary

50RIESGO

abrir ↗

Referência

CVE-2025-34030

CVE-2025-34030CRITICAL

sar2html OS Command Injection

75RIESGO

abrir ↗

Referência

CVE-2018-6065

CVE-2018-6065HIGHbajo ataque

Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Ch

83RIESGO

abrir ↗

Referência

CVE-2021-33393

CVE-2021-33393—

lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It

50RIESGO

abrir ↗

Referência

CVE-2012-2576

CVE-2012-2576—

SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Prof

50RIESGO

abrir ↗

Referência✓ VexDay Proof

Amaya Web Editor 11.0 - XML / HTML Parser

CVE-2009-0323—doswindows

Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary

50RIESGO

abrir ↗

Referência

CVE-2015-1503

CVE-2015-1503—

Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary

50RIESGO

abrir ↗

Referência✓ VexDay Proof

Simplog 0.9.2 - 's' Remote Command Execution

CVE-2006-1779—webappsphp

Cross-site scripting (XSS) vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attacke

23RIESGO

abrir ↗

Referência

CVE-2009-3260

CVE-2009-3260—

Cross-site scripting (XSS) vulnerability in LiveStreet 0.2 allows remote attackers to inject arbitrary web script or HTM

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.