Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.795exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.220VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.463 exploits
Referência✓ VexDay Proof
Buddy Zone 1.5 - Multiple SQL Injections
CVE-2007-3526—webappsphp
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência
CVE-2007-3529
CVE-2007-3529—
videos.php in PHPDirector 0.21 and earlier allows remote attackers to obtain sensitive information via an empty value of
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6949—webappsphp
Multiple cross-site request forgery (CSRF) vulnerabilities in Collabtive 0.4.8 allow remote attackers to hijack the auth
23RIESGO
abrir ↗
Referência
CVE-2010-1980
CVE-2010-1980—
Directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla
43RIESGO
abrir ↗
Referência
CVE-2016-1104
CVE-2016-1104—
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof
35RIESGO
abrir ↗
Referência✓ VexDay Proof
Podcast Generator 1.1 - Remote Code Execution
CVE-2009-1230—webappsphp
Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated admini
23RIESGO
abrir ↗
Referência
CVE-2017-15967
CVE-2017-15967—
Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the e
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Worldweaver DX Studio Player < 3.0.29.1 Firefox plugin - Command Injection
CVE-2009-2011—remotewindows
Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a p
50RIESGO
abrir ↗
Referência
CVE-2009-3417
CVE-2009-3417—
SQL injection vulnerability in the IDoBlog (com_idoblog) component 1.1 build 30 for Joomla! allows remote attackers to e
23RIESGO
abrir ↗
Referência
CVE-2025-55241
CVE-2025-55241CRITICAL
Azure Entra ID Elevation of Privilege Vulnerability
48RIESGO
abrir ↗
Referência✓ VexDay Proof
GPS CMS 1.2 - 'print.asp' SQL Injection
CVE-2007-0554—webappsasp
SQL injection vulnerability in print.asp in Guo Xu Guos Posting System (GPS) 1.2 allows remote attackers to execute arbi
23RIESGO
abrir ↗
Referência
CVE-2018-25368
CVE-2018-25368HIGH
Nord VPN 6.14.31 Denial of Service via Password Field
41RIESGO
abrir ↗
Referência
CVE-2021-4464
CVE-2021-4464CRITICAL
FIberHome AN5506-04-FA / HG6245D Routers Remote Stack Overflow
48RIESGO
abrir ↗
Referência
CVE-2021-4464
CVE-2021-4464CRITICAL
FIberHome AN5506-04-FA / HG6245D Routers Remote Stack Overflow
48RIESGO
abrir ↗
Referência
CVE-2026-78837
CVE-2026-78837HIGH
A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitiv
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Buddy Zone 1.5 - 'view_sub_cat.php?cat_id' SQL Injection
CVE-2007-3549—webappsphp
SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL comma
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Constructr CMS 3.02.5 stable - Multiple Vulnerabilities
CVE-2008-5847—webappsphp
Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent atta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
E-Store Kit-1 < 2 PayPal Edition - 'pid' SQL Injection
CVE-2008-3594—webappsphp
SQL injection vulnerability in viewdetails.php in MagicScripts E-Store Kit-1, E-Store Kit-2, E-Store Kit-1 Pro PayPal Ed
23RIESGO
abrir ↗
Referência
CVE-2015-7247
CVE-2015-7247—
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and
28RIESGO
abrir ↗
Referência
CVE-2008-4751
CVE-2008-4751—
Cross-site scripting (XSS) vulnerability in index.php in iPei Guestbook 2.0 allows remote attackers to inject arbitrary
23RIESGO
abrir ↗
Referência
CVE-2026-9440
CVE-2026-9440MEDIUM
Edimax BR-6478AC POST Request formAccept command injection
38RIESGO
abrir ↗
Referência
CVE-2010-2016
CVE-2010-2016—
SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência
CVE-2017-15974
CVE-2017-15974—
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
23RIESGO
abrir ↗
Referência
CVE-2017-15975
CVE-2017-15975—
Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability
23RIESGO
abrir ↗
Referência✓ VexDay Proof
yogurt 0.3 - Cross-Site Scripting / SQL Injection
CVE-2009-2034—webappsphp
SQL injection vulnerability in writemessage.php in Yogurt 0.3, when register_globals is enabled, allows remote authentic
23RIESGO
abrir ↗
Referência
CVE-2010-0703
CVE-2010-0703—
Cross-site scripting (XSS) vulnerability in wa/auth in PortWise SSL VPN 4.6 allows remote attackers to inject arbitrary
23RIESGO
abrir ↗
Referência
CVE-2026-111738
CVE-2026-111738MEDIUM
Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option
33RIESGO
abrir ↗
Referência
CVE-2026-9295
CVE-2026-9295HIGH
Edimax BR-6428NS POST Request formWirelessTbl buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2019-9701
CVE-2019-9701—
DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue th
23RIESGO
abrir ↗
Referência
CVE-2020-13927
CVE-2020-13927CRITICALbajo ataque
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th
100RIESGO
abrir ↗
← anteriorpágina 744 / 883siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.