Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.788exploits catalogados
40.761CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.213VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.463 exploits
Referência
CVE-2019-8943
CVE-2019-8943—
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can
60RIESGO
abrir ↗
Referência✓ VexDay Proof
maGAZIn 2.0 - 'PHPThumb.php?src' Remote File Disclosure
CVE-2007-2643—webappsphp
Directory traversal vulnerability in phpThumb.php in PinkCrow Designs Gallery or maGAZIn 2.0 allows remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2019-8943
CVE-2019-8943—
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can
60RIESGO
abrir ↗
Referência
CVE-2026-80467
CVE-2026-80467HIGH
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
41RIESGO
abrir ↗
Referência
CVE-2009-3966
CVE-2009-3966—
Arcade Trade Script 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the a
23RIESGO
abrir ↗
Referência
CVE-2010-1948
CVE-2010-1948—
Directory traversal vulnerability in scr/soustab.php in openMairie Openfoncier 2.00, when register_globals is enabled, a
23RIESGO
abrir ↗
Referência
CVE-2010-1948
CVE-2010-1948—
Directory traversal vulnerability in scr/soustab.php in openMairie Openfoncier 2.00, when register_globals is enabled, a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
XZero Community Classifieds 4.95.11 - Remote File Inclusion
CVE-2007-6568—webappsphp
PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remo
23RIESGO
abrir ↗
Referência
CVE-2014-1459
CVE-2014-1459—
SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administra
23RIESGO
abrir ↗
Referência
CVE-2015-4877
CVE-2015-4877—
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Freelance Auction Script 1.0 - 'browseproject.php' SQL Injection
CVE-2008-2279—webappsphp
Freelance Auction Script 1.0 stores user passwords in plaintext in the tbl_users table, which allows attackers to gain p
23RIESGO
abrir ↗
Referência
CVE-2024-36840
CVE-2024-36840CRITICAL
SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code a
48RIESGO
abrir ↗
Referência
CVE-2024-36840
CVE-2024-36840CRITICAL
SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code a
48RIESGO
abrir ↗
Referência
CVE-2026-96895
CVE-2026-96895MEDIUM
WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes
33RIESGO
abrir ↗
Referência
CVE-2026-82593
CVE-2026-82593CRITICAL
D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow
48RIESGO
abrir ↗
Referência
CVE-2023-42628
CVE-2023-42628CRITICAL
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay
48RIESGO
abrir ↗
Referência
CVE-2023-42629
CVE-2023-42629CRITICAL
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87,
48RIESGO
abrir ↗
Referência
CVE-2015-5591
CVE-2015-5591—
SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
23RIESGO
abrir ↗
Referência
CVE-2026-82669
CVE-2026-82669MEDIUM
klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service
33RIESGO
abrir ↗
Referência
CVE-2009-4433
CVE-2009-4433—
Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 and earlier allow remote attackers to injec
23RIESGO
abrir ↗
Referência
CVE-2011-5222
CVE-2011-5222—
SQL injection vulnerability in rub2_w.php in PHP Flirt-Projekt 4.8 and possibly earlier allows remote attackers to execu
23RIESGO
abrir ↗
Referência
CVE-2013-3536
CVE-2013-3536—
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and ea
23RIESGO
abrir ↗
Referência
CVE-2017-16567
CVE-2017-16567—
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. T
23RIESGO
abrir ↗
Referência
CVE-2013-3536
CVE-2013-3536—
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and ea
23RIESGO
abrir ↗
Referência
CVE-2014-3934
CVE-2014-3934—
SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2024-25414
CVE-2024-25414CRITICAL
An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code vi
48RIESGO
abrir ↗
Referência
CVE-2018-10313
CVE-2018-10313—
WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set
23RIESGO
abrir ↗
Referência
CVE-2026-82619
CVE-2026-82619MEDIUM
Systerel S2OPC subscription_mgr.c use after free
33RIESGO
abrir ↗
Referência✓ VexDay Proof
NagiosQL 2005 2.00 - 'prepend_adm.php' Remote File Inclusion
CVE-2007-2709—webappsphp
PHP remote file inclusion vulnerability in functions/prepend_adm.php in NagiosQL 2005 2.00 allows remote attackers to ex
23RIESGO
abrir ↗
Referência
CVE-2009-2780
CVE-2009-2780—
Multiple cross-site scripting (XSS) vulnerabilities in 68 Classifieds 4.1 allow remote attackers to inject arbitrary web
23RIESGO
abrir ↗
← anteriorpágina 739 / 883siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.