Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

81.859exploits catalogados
38.203CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.483Referência 24.469GitHub PoC 15.768VulnCheck XDB 9182Nuclei 4447Metasploit 3510✓ solo verificadosrecientespopularesriesgo
24.695 exploits
Referência✓ VexDay Proof
Rianxosencabos CMS 0.9 - Arbitrary Add Admin
CVE-2008-4245—webappsphp
The Admin Control Panel in Rianxosencabos CMS 0.9 does not require administrator privileges, which allows remote authent
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Fusion Module Arcade 1.0 - 'cid' SQL Injection
CVE-2007-1978—webappsphp
SQL injection vulnerability in index.php in the Arcade 1.00 module for PHP-Fusion allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência✓ VexDay Proof
eSyndiCat Link Exchange Script 2005-2006 - SQL Injection
CVE-2007-6543—webappsphp
SQL injection vulnerability in suggest-link.php in eSyndiCat Link Exchange Script allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência✓ VexDay Proof
RunCMS 1.6 - Get Admin Cookie Blind SQL Injection
CVE-2007-6544—webappsphp
Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗
Referência✓ VexDay Proof
1024 CMS 1.4.2 - Local File Inclusion / Blind SQL Injection
CVE-2008-1911—webappsphp
SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magic_quotes_gpc is disabled
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Easy Photo Gallery 2.1 - Cross-Site Scripting / File Disclosure/Bypass / SQL Injection
CVE-2008-6988—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo Gallery (aka Ezphotogallery) 2.1 allow remote attacker
23RIESGO
abrir ↗
Referência✓ VexDay Proof
InstaGuide Weather Script 1.0 - 'index.php' Local File Inclusion
CVE-2007-5674—webappsphp
Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WBB2-Addon: Acrotxt 1.0 - 'show' SQL Injection
CVE-2007-4581—webappsphp
SQL injection vulnerability in acrotxt.php in WBB2-Addon: Acrotxt 1 allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TeamCalPro 3.1.000 - Multiple Local/Remote File Inclusions
CVE-2007-6553—webappsphp
Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component mosDirectory 2.3.2 - Remote File Inclusion
CVE-2007-6555—webappsphp
PHP remote file inclusion vulnerability in modules/mod_pxt_latest.php in the mosDirectory (com_directory) 2.3.2 componen
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Wallpaper Site 1.0.09 - 'category.php' SQL Injection
CVE-2007-6580—webappsphp
Multiple SQL injection vulnerabilities in Wallpaper Site 1.0.09 allow remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência✓ VexDay Proof
1024 CMS 1.3.1 - Local File Inclusion / SQL Injection
CVE-2007-6584—webappsphp
Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary l
23RIESGO
abrir ↗
Referência✓ VexDay Proof
NmnNewsletter 1.0.7 - 'output' Remote File Inclusion
CVE-2007-6585—webappsphp
PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to e
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP 5.2.3 - PHP_ntuser ntuser_getuserlist() Local Buffer Overflow (PoC)
CVE-2007-4507—doswindows
Multiple buffer overflows in the php_ntuser component for PHP 5.2.3 allow context-dependent attackers to cause a denial
23RIESGO
abrir ↗
Referência✓ VexDay Proof
FlexPHPDirectory 0.0.1 - Authentication Bypass
CVE-2008-6749—webappsphp
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPDirectory 0.0.1, when magic_quotes_gpc is disabl
23RIESGO
abrir ↗
Referência✓ VexDay Proof
actSite 1.991 Beta - 'base.php' Remote File Inclusion
CVE-2007-5175—webappsphp
PHP remote file inclusion vulnerability lib/base.php in actSite 1.991 Beta allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP ZLink 0.3 - 'go.php' SQL Injection
CVE-2007-6578—webappsphp
SQL injection vulnerability in go.php in PHP ZLink 0.3 allows remote attackers to execute arbitrary SQL commands via the
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component com_Marketplace 1.1.1 - SQL Injection
CVE-2008-0689—webappsphp
SQL injection vulnerability in index.php in the Marketplace (com_marketplace) 1.1.1 and 1.1.1-pl1 component for Joomla!
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP 'FFI' Extension 5.0.5 - 'Safe_mode' Local Bypass
CVE-2007-4528—localwindows
The Foreign Function Interface (ffi) extension in PHP 5.0.5 does not follow safe_mode restrictions, which allows context
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component netinvoice 1.2.0 SP1 - SQL Injection
CVE-2008-3498—webappsphp
SQL injection vulnerability in the nBill (com_netinvoice) component 1.2.0 SP1 for Joomla! allows remote attackers to exe
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Flatnuke 3 - Remote Cookie Manipulation / Privilege Escalation
CVE-2007-5771—webappsphp
Flatnuke 3 (aka FlatnuX) allows remote attackers to obtain administrative access via a myforum%00 cookie.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
poweraward 1.1.0 rc1 - Local File Inclusion / Cross-Site Scripting
CVE-2008-5204—webappsphp
Multiple directory traversal vulnerabilities in PowerAward 1.1.0 RC1, when register_globals is enabled, allow remote att
23RIESGO
abrir ↗
Referência✓ VexDay Proof
SetCMS 3.6.5 - Remote Command Execution
CVE-2008-0478—webappsphp
Directory traversal vulnerability in index.php in SetCMS 3.6.5 allows remote attackers to include and execute arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
CVE-2009-1780—webappsphp
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, wh
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Flatnuke 3 - Remote Command Execution / Privilege Escalation
CVE-2007-5773—webappsphp
Cross-site request forgery (CSRF) vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote atta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
AuraCMS Forum Module - SQL Injection
CVE-2007-4171—webappsphp
SQL injection vulnerability in komentar.php in the Forum Module for auraCMS (Modul Forum Sederhana) allows remote attack
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Angelo-Emlak 1.0 - Multiple SQL Injections
CVE-2008-2048—webappsasp
Cross-site scripting (XSS) vulnerability in hpz/admin/Default.asp in Angelo-Emlak 1.0 allows remote attackers to inject
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Yet Another NOCC 0.1.0 - Local File Inclusion
CVE-2009-0515—webappsphp
Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attacke
23RIESGO
abrir ↗
Referência✓ VexDay Proof
matpo bilder galerie 1.1 - Remote File Inclusion
CVE-2007-6649—webappsphp
PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Bitweaver R2 CMS - Arbitrary File Upload / Disclosure
CVE-2007-6650—webappsphp
Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbit
23RIESGO
abrir ↗
← anteriorpágina 726 / 824siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.