Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.464exploits catalogados
40.695CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.426Exploit-DB 24.489GitHub PoC 18.182VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.426 exploits
Referência
CVE-2012-0981
CVE-2012-0981—
Directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image fil
38RIESGO
abrir ↗
Referência✓ VexDay Proof
Xpression News 1.0.1 - 'archives.php' Remote File Disclosure
CVE-2007-1040—webappsphp
Directory traversal vulnerability in archives.php in Xpression News (X-News) 1.0.1 allows remote attackers to include ar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WordPress Plugin wp-Table 1.43 - 'inc_dir' Remote File Inclusion
CVE-2007-2484—webappsphp
PHP remote file inclusion vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress,
35RIESGO
abrir ↗
Referência✓ VexDay Proof
PStruh-CZ 1.3/1.5 - 'download.asp' File Disclosure
CVE-2007-2486—webappsasp
Directory traversal vulnerability in download.asp in Motobit 1.3 and 1.5 (aka PStruh-CZ) allows remote attackers to read
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Xserver 0.1 Alpha - 'POST' Remote Buffer Overflow (PoC)
CVE-2007-3957—doslinux
Buffer overflow in Nipun Jain xserver 0.1 alpha allows remote attackers to cause a denial of service via a POST request
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Microsoft Internet Explorer - XML Parsing Remote Buffer Overflow
CVE-2008-4844—remotewindows
Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet
50RIESGO
abrir ↗
Referência✓ VexDay Proof
Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities
CVE-2008-4876—remotehardware
Cross-site scripting (XSS) vulnerability in the web server component in Philips Electronics VOIP841 DECT Phone with firm
23RIESGO
abrir ↗
Referência
CVE-2011-4106
CVE-2011-4106—
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote a
28RIESGO
abrir ↗
Referência
Sanitized XenForo write-up and proof of concept for CVE-2026-73316.
CVE-2026-73316HIGH
XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
41RIESGO
abrir ↗
Referência
Sanitized XenForo write-up and proof of concept for CVE-2026-73315.
CVE-2026-73315HIGH
XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
41RIESGO
abrir ↗
Referência✓ VexDay Proof
RunCMS 1.5.2 - 'debug_show.php' SQL Injection
CVE-2007-2539—webappsphp
The show_files function in RunCms 1.5.2 and earlier allows remote attackers to obtain sensitive information (file existe
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PMECMS 1.0 - config[pathMod] Remote File Inclusion
CVE-2007-2540—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PMECMS 1.0 and earlier allow remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPNews 0.93 - 'format_menue' Remote File Inclusion
CVE-2007-4232—webappsphp
PHP remote file inclusion vulnerability in admin/inc/change_action.php in Andreas Robertz PHPNews 0.93 allows remote att
35RIESGO
abrir ↗
Referência✓ VexDay Proof
Falt4 CMS rc4 10.9.2007 - Multiple Vulnerabilities
CVE-2007-6311—webappsphp
SQL injection vulnerability in (1) index.php, and possibly (2) admin/index.php, in Falt4Extreme RC4 10.9.2007 allows rem
23RIESGO
abrir ↗
Referência✓ VexDay Proof
FTP Now 2.6 Server - Response Remote Crash (PoC)
CVE-2008-5045—doswindows
Heap-based buffer overflow in Network-Client FTP Now 2.6, and possibly other versions, allows remote FTP servers to caus
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Microsoft GDI Plugin - '.png' Infinite Loop Denial of Service (PoC)
CVE-2009-1511—doswindows
GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file tha
28RIESGO
abrir ↗
Referência✓ VexDay Proof
TemaTres 1.0.3 - Blind SQL Injection
CVE-2009-1584—webappsphp
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote atta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Web Wiz Guestbook 8.21 - Database Disclosure
CVE-2003-1571—webappsasp
Web Wiz Guestbook 6.0 stores sensitive information under the web root with insufficient access control, which allows rem
23RIESGO
abrir ↗
Referência✓ VexDay Proof
μTorrent (uTorrent) / BitTorrent WebIU HTTP 1.7.7/6.0.1 - Range header Denial of Service
CVE-2008-0071—doswindows
The Web UI interface in (1) BitTorrent before 6.0.3 build 8642 and (2) uTorrent before 1.8beta build 10524 allows remote
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MyPHP Forum 3.0 - 'Final' SQL Injection
CVE-2008-0099—webappsphp
Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗
Referência✓ VexDay Proof
SebracCMS 0.4 - Multiple SQL Injections
CVE-2008-5195—webappsphp
Multiple SQL injection vulnerabilities in SebracCMS (sbcms) 0.4 allow remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component Xe webtv - 'id' Blind SQL Injection
CVE-2008-5200—webappsphp
SQL injection vulnerability in the Xe webtv (com_xewebtv) component for Joomla! allows remote attackers to execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
FREEze Greetings 1.0 - Remote Password Retrieve
CVE-2008-5218—webappsphp
ScriptsEz FREEze Greetings 1.0 stores pwd.txt under the web root with insufficient access control, which allows remote a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Clean CMS 1.5 - Blind SQL Injection / Cross-Site Scripting
CVE-2008-5289—webappsphp
SQL injection vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência
CVE-2011-5164
CVE-2011-5164—
Stack-based buffer overflow in VanDyke Software AbsoluteFTP 1.9.6 through 2.2.10 allows remote FTP servers to execute ar
43RIESGO
abrir ↗
Referência
CVE-2012-0391
CVE-2012-0391CRITICALbajo ataque
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Nukedit 4.9.x - Remote Create Admin
CVE-2008-5582—webappsphp
SQL injection vulnerability in utilities/login.asp in Nukedit 4.9.x, and possibly earlier, allows remote attackers to ex
23RIESGO
abrir ↗
Referência
CVE-2014-5347
CVE-2014-5347—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress
23RIESGO
abrir ↗
Referência
Ericsson Network Location MPS GMPC21 - Remote Code Execution (RCE) (Metasploit)
CVE-2021-43339—webappsmultiple
In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file
23RIESGO
abrir ↗
Referência
CVE-2012-0393
CVE-2012-0393—
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which
35RIESGO
abrir ↗
← anteriorpágina 703 / 881siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.