Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.426 exploits
Referência
php-fusion 9.03.50 - Persistent Cross-Site Scripting
CVE-2020-12706—webappsphp
Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web scrip
23RIESGO
abrir ↗
Referência
CVE-2011-5129
CVE-2011-5129—
Heap-based buffer overflow in XChat 2.8.9 and earlier allows remote attackers to cause a denial of service (crash) and p
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CyberBrau 0.9.4 - '/forum/track.php' Remote File Inclusion
CVE-2006-5400—webappsphp
PHP remote file inclusion vulnerability in forum/track.php in CyberBrau 0.9.4, when register_globals is enabled, allows
23RIESGO
abrir ↗
Referência
CVE-2014-3136
CVE-2014-3136—
Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote a
23RIESGO
abrir ↗
Referência
CVE-2012-5849
CVE-2012-5849—
Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbi
23RIESGO
abrir ↗
Referência
CVE-2012-0781
CVE-2012-0781—
The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer derefere
28RIESGO
abrir ↗
Referência✓ VexDay Proof
NMDeluxe 1.0.1 - 'footer.php?template' Local File Inclusion
CVE-2007-2303—webappsphp
Directory traversal vulnerability in includes/footer.php in News Manager Deluxe (NMDeluxe) 1.0.1 allows remote attackers
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Stats 0.1.9.2 - Multiple Vulnerabilities
CVE-2007-5452—webappsphp
Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arb
23RIESGO
abrir ↗
Referência✓ VexDay Proof
xeCMS 1.x - 'view.php' Remote File Disclosure
CVE-2007-6508—webappsphp
Directory traversal vulnerability in view.php in xeCMS 1.0 allows remote attackers to read arbitrary files via a ..%2F (
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Pollbooth 2.0 - 'pollID' SQL Injection
CVE-2008-4765—webappsphp
SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbi
23RIESGO
abrir ↗
Referência
CVE-2013-5099
CVE-2013-5099—
Cross-site scripting (XSS) vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote at
23RIESGO
abrir ↗
Referência
CVE-2018-0745
CVE-2018-0745—
The Windows kernel in Windows 10 version 1703. Windows 10 version 1709, and Windows Server, version 1709 allows an infor
23RIESGO
abrir ↗
Referência
CVE-2026-15597
CVE-2026-15597MEDIUM
SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-15559
CVE-2026-15559MEDIUM
CodeAstro Simple Online Leave Management System POST accept.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2019-1344
CVE-2019-1344—
An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memo
23RIESGO
abrir ↗
Referência
CVE-2026-77770
CVE-2026-77770CRITICAL
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
48RIESGO
abrir ↗
Referência
CVE-2012-0901
CVE-2012-0901—
Cross-site scripting (XSS) vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows r
38RIESGO
abrir ↗
Referência
CVE-2010-4719
CVE-2010-4719—
Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to r
43RIESGO
abrir ↗
Referência
CVE-2012-5905
CVE-2012-5905—
Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string
23RIESGO
abrir ↗
Referência
CVE-2023-28293
CVE-2023-28293HIGH
Windows Kernel Elevation of Privilege Vulnerability
41RIESGO
abrir ↗
Referência
CVE-2012-5905
CVE-2012-5905—
Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string
23RIESGO
abrir ↗
Referência
CVE-2014-4511
CVE-2014-4511—
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in
60RIESGO
abrir ↗
Referência✓ VexDay Proof
eMeeting Online Dating Software 5.2 - SQL Injection
CVE-2007-3609—webappsphp
Multiple SQL injection vulnerabilities in eMeeting Online Dating Software 5.2 allow remote attackers to execute arbitrar
23RIESGO
abrir ↗
Referência
CVE-2008-4648
CVE-2008-4648—
Cross-site scripting (XSS) vulnerability in index.php in Elxis CMS 2008.1 revision 2204 allows remote attackers to injec
23RIESGO
abrir ↗
Referência
CVE-2026-11875
CVE-2026-11875MEDIUM
WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery
33RIESGO
abrir ↗
Referência
CVE-2026-19977
CVE-2026-19977CRITICAL
EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication
48RIESGO
abrir ↗
Referência
CVE-2026-23698
CVE-2026-23698HIGH
Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload
41RIESGO
abrir ↗
Referência
CVE-2010-4771
CVE-2010-4771—
SQL injection vulnerability to viewforum.php in S-CMS 2.5 allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência
CVE-2026-15375
CVE-2026-15375MEDIUM
Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-19970
CVE-2026-19970MEDIUM
Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow
33RIESGO
abrir ↗
← anteriorpágina 693 / 881siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.