Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.806exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.231VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.463 exploits
Referência
CVE-2023-6036
CVE-2023-6036CRITICAL
Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass
48RIESGO
abrir ↗
Referência
CVE-2015-7297
CVE-2015-7297—
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un
60RIESGO
abrir ↗
Referência
CVE-2017-0148
CVE-2017-0148HIGHbajo ataqueransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗
Referência
CVE-2017-15978
CVE-2017-15978—
AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
mutiple timesheets 5.0 - Multiple Vulnerabilities
CVE-2008-1414—webappsphp
Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ViArt Shop 3.5 - 'category_id' SQL Injection
CVE-2008-3369—webappsphp
SQL injection vulnerability in products_rss.php in ViArt Shop 3.5 and earlier allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-6510—webappsjsp
Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PlaySms 0.9.3 - Multiple Local/Remote File Inclusions
CVE-2009-0103—webappsphp
Multiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Mundi Mail 0.8.2 - 'top' Remote File Inclusion
CVE-2009-2095—webappsphp
PHP remote file inclusion vulnerability in template/simpledefault/admin/_masterlayout.php in Mundi Mail 0.8.2, when regi
23RIESGO
abrir ↗
Referência
CVE-2010-1921
CVE-2010-1921—
Multiple PHP remote file inclusion vulnerabilities in OpenMairie openAnnuaire 2.00, when register_globals is enabled, al
23RIESGO
abrir ↗
Referência
CVE-2010-2020
CVE-2010-2020—
sys/nfsclient/nfs_vfsops.c in the NFS client in the kernel in FreeBSD 7.2 through 8.1-PRERELEASE, when vfs.usermount is
23RIESGO
abrir ↗
Referência
CVE-2010-2035
CVE-2010-2035—
Directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote
43RIESGO
abrir ↗
Referência
CVE-2017-15979
CVE-2017-15979—
Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-10165
CVE-2026-10165HIGH
Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2024-6039
CVE-2024-6039MEDIUM
Feng Office Workspaces sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-113499
CVE-2026-113499HIGH
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
41RIESGO
abrir ↗
Referência
CVE-2026-66754
CVE-2026-66754HIGH
Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding
41RIESGO
abrir ↗
Referência
CVE-2026-113472
CVE-2026-113472MEDIUM
Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload
33RIESGO
abrir ↗
Referência✓ VexDay Proof
OneCMS 2.4 - SQL Injection / Upload
CVE-2008-7208—webappsphp
Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Claroline 1.7.6 - 'includePath' Remote Code Execution
CVE-2006-2868—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.6 allow remote attackers to execute arbitrary PHP co
28RIESGO
abrir ↗
Referência
CVE-2009-3512
CVE-2009-3512—
Multiple cross-site scripting (XSS) vulnerabilities in MyWeight 1.0 allow remote attackers to inject arbitrary web scrip
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (1)
CVE-2007-3587—webappsphp
MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a
23RIESGO
abrir ↗
Referência
CVE-2026-5978
CVE-2026-5978CRITICAL
Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection
48RIESGO
abrir ↗
Referência
CVE-2017-15981
CVE-2017-15981—
Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for fo
23RIESGO
abrir ↗
Referência
CVE-2017-15982
CVE-2017-15982—
Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
AuraCMS 2.2 - 'albums' Pramater SQL Injection
CVE-2008-0735—webappsphp
SQL injection vulnerability in mod/gallery/ajax/gallery_data.php in AuraCMS 2.2 allows remote attackers to execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Yblog 0.2.2.2 - Cross-Site Scripting / SQL Injection
CVE-2008-2668—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in yBlog 0.2.2.2 allow remote attackers to inject arbitrary web scri
23RIESGO
abrir ↗
Referência
CVE-2010-1928
CVE-2010-1928—
Directory traversal vulnerability in scr/soustab.php in openMairie openPlanning 1.00, when register_globals is enabled,
23RIESGO
abrir ↗
Referência
CVE-2010-1936
CVE-2010-1936—
Directory traversal vulnerability in scr/soustab.php in openMairie openComInterne 1.01, when register_globals is enabled
23RIESGO
abrir ↗
Referência
CVE-2019-9553
CVE-2019-9553—
Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and
23RIESGO
abrir ↗
← anteriorpágina 748 / 883siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.