Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.513exploits catalogados
40.739CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.194VulnCheck XDB 10.251Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.463 exploits
Referência
CVE-2026-84111
CVE-2026-84111MEDIUM
Chanjet CRM jxf_dump_table.php sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
myPHPCalendar 10192000b - 'cal_dir' Remote File Inclusion
CVE-2006-6812—webappsphp
Multiple PHP remote file inclusion vulnerabilities in myPHPCalendar 10.1 allow remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗
Referência
CVE-2013-2594
CVE-2013-2594—
SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote at
23RIESGO
abrir ↗
Referência
CVE-2015-5075
CVE-2015-5075—
Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authe
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP FirstPost 0.1 - 'block.php?Include' Remote File Inclusion
CVE-2007-2665—webappsphp
PHP remote file inclusion vulnerability in block.php in PhpFirstPost 0.1 allows remote attackers to execute arbitrary PH
23RIESGO
abrir ↗
Referência
CVE-2010-1350
CVE-2010-1350—
SQL injection vulnerability in the JP Jobs (com_jp_jobs) component 1.4.1 and earlier for Joomla! allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2010-1467
CVE-2010-1467—
Multiple PHP remote file inclusion vulnerabilities in openUrgence Vaccin 1.03 allow remote attackers to execute arbitrar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
minimal Gallery 0.8 - Remote File Disclosure
CVE-2008-0259—webappsphp
Multiple directory traversal vulnerabilities in _mg/php/mg_thumbs.php in minimal Gallery 0.8 allow remote attackers to r
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Netartmedia Cars Portal 2.0 - SQL Injection
CVE-2008-5310—webappsphp
SQL injection vulnerability in image.php in NetArt Media Car Portal 2.0 allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ASP Download 1.03 - Arbitrary Change Administrator Account
CVE-2008-6739—webappsasp
Todd Woolums ASP Download management script 1.03 does not require authentication for setupdownload.asp, which allows rem
23RIESGO
abrir ↗
Referência✓ VexDay Proof
S-CMS 1.1 Stable - 'page' Local File Inclusion
CVE-2009-1502—webappsphp
Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and exe
23RIESGO
abrir ↗
Referência
CVE-2009-4670
CVE-2009-4670—
admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arb
23RIESGO
abrir ↗
Referência
CVE-2009-4801
CVE-2009-4801—
EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via re
23RIESGO
abrir ↗
Referência
CVE-2024-36840
CVE-2024-36840CRITICAL
SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code a
48RIESGO
abrir ↗
Referência
CVE-2024-36840
CVE-2024-36840CRITICAL
SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code a
48RIESGO
abrir ↗
Referência
CVE-2026-96895
CVE-2026-96895MEDIUM
WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes
33RIESGO
abrir ↗
Referência
CVE-2026-82593
CVE-2026-82593CRITICAL
D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow
48RIESGO
abrir ↗
Referência
CVE-2023-42628
CVE-2023-42628CRITICAL
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay
48RIESGO
abrir ↗
Referência
CVE-2023-42629
CVE-2023-42629CRITICAL
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87,
48RIESGO
abrir ↗
Referência
CVE-2015-5591
CVE-2015-5591—
SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
23RIESGO
abrir ↗
Referência
CVE-2026-82669
CVE-2026-82669MEDIUM
klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service
33RIESGO
abrir ↗
Referência
CVE-2009-4433
CVE-2009-4433—
Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 and earlier allow remote attackers to injec
23RIESGO
abrir ↗
Referência
CVE-2011-5222
CVE-2011-5222—
SQL injection vulnerability in rub2_w.php in PHP Flirt-Projekt 4.8 and possibly earlier allows remote attackers to execu
23RIESGO
abrir ↗
Referência
CVE-2013-3536
CVE-2013-3536—
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and ea
23RIESGO
abrir ↗
Referência
CVE-2017-16567
CVE-2017-16567—
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. T
23RIESGO
abrir ↗
Referência
CVE-2013-3536
CVE-2013-3536—
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and ea
23RIESGO
abrir ↗
Referência
CVE-2014-3934
CVE-2014-3934—
SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2024-25414
CVE-2024-25414CRITICAL
An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code vi
48RIESGO
abrir ↗
Referência
CVE-2018-10313
CVE-2018-10313—
WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set
23RIESGO
abrir ↗
Referência
CVE-2026-82619
CVE-2026-82619MEDIUM
Systerel S2OPC subscription_mgr.c use after free
33RIESGO
abrir ↗
← anteriorpágina 735 / 883siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.