Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
82.035exploits catalogados
38.336CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 24.566Exploit-DB 24.485GitHub PoC 15.817VulnCheck XDB 9205Nuclei 4449Metasploit 3513✓ solo verificadosrecientespopularesriesgo
24.695 exploits
Referência✓ VexDay Proof
Orbit Downloader 2.8.7 - Arbitrary File Deletion
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allow
23RIESGO
abrir ↗Referência✓ VexDay Proof
Xfire 1.6.4 - Remote Denial of Service
Xfire 1.64 and earlier allows remote attackers to cause a denial of service (client application crash) via a long string
23RIESGO
abrir ↗Referência✓ VexDay Proof
phpBB PlusXL 2.0_272 - 'constants.php' Remote File Inclusion
PHP remote file inclusion vulnerability in mods/iai/includes/constants.php in the PlusXL 20_272 and earlier phpBB module
23RIESGO
abrir ↗Referência✓ VexDay Proof
Drake CMS 0.4.11 - Blind SQL Injection
SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earl
23RIESGO
abrir ↗Referência✓ VexDay Proof
Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
RTE_popup_save_file.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload (1) .html and (2) .htm files v
23RIESGO
abrir ↗Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web
23RIESGO
abrir ↗Referência✓ VexDay Proof
Noticeware Email Server 4.6.1.0 - Denial of Service
MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application cras
23RIESGO
abrir ↗Referência✓ VexDay Proof
Scientific Image DataBase 0.41 - Blind SQL Injection
SQL injection vulnerability in projects.php in Scientific Image DataBase 0.41 allows remote attackers to execute arbitra
23RIESGO
abrir ↗Referência✓ VexDay Proof
CF_Calendar - 'calendarevent.cfm' SQL Injection
SQL injection vulnerability in calendarevent.cfm in CF_Calendar allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗Referência✓ VexDay Proof
wavewoo 0.1.1 - 'loading.php?path_include' Remote File Inclusion
PHP remote file inclusion vulnerability in include/loading.php in Alessandro Lulli wavewoo 0.1.1 allows remote attackers
23RIESGO
abrir ↗Referência✓ VexDay Proof
Advanced Webhost Billing System (AWBS) 2.4.0 - 'cart2.php' Remote File Inclusion
PHP remote file inclusion vulnerability in docs/front-end-demo/cart2.php in Advanced Webhost Billing System (AWBS) 2.4.0
23RIESGO
abrir ↗Referência✓ VexDay Proof
Easy Photo Gallery 2.1 - Arbitrary Add Admin / remove user
useradmin.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 does not require administrative authentication, which allow
23RIESGO
abrir ↗Referência✓ VexDay Proof
Hannon Hill Cascade Server - (Authenticated) Command Execution
Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Jav
28RIESGO
abrir ↗Referência✓ VexDay Proof
LoveCMS 1.6.2 Final - Arbitrary File Delete
Directory traversal vulnerability in system/admin/images.php in LoveCMS 1.6.2 Final allows remote attackers to delete ar
23RIESGO
abrir ↗Referência✓ VexDay Proof
Goople CMS 1.7 - Insecure Cookie Handling
win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access
23RIESGO
abrir ↗Referência✓ VexDay Proof
Adult Banner Exchange Website - 'targetid' SQL Injection
SQL injection vulnerability in click.php in Adult Banner Exchange Website allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗Referência✓ VexDay Proof
fhttpd 0.4.2 - 'un64()' Remote Denial of Service
fhttpd 0.4.2 allows remote attackers to cause a denial of service (crash) via an Authorization HTTP header with an inval
23RIESGO
abrir ↗Referência✓ VexDay Proof
Hot Open Tickets 11012004 - 'CLASS_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/lib_action_step.php in Hot Open Tickets (HOT) 11012004_ver2f, when regi
23RIESGO
abrir ↗Referência✓ VexDay Proof
PPLive 1.9.21 - '/LoadModule' URI Handlers Argument Injection
Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute
23RIESGO
abrir ↗Referência✓ VexDay Proof
Drupal 4.7 - 'Attachment mod_mime' Remote Command Execution
Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple
28RIESGO
abrir ↗Referência✓ VexDay Proof
Azucar CMS 1.3 - '/admin/index_sitios.php' File Inclusion
PHP remote file inclusion vulnerability in admin/index_sitios.php in Azucar CMS 1.3 allows remote attackers to execute a
23RIESGO
abrir ↗Referência✓ VexDay Proof
TemaTres 1.0.3 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote atta
23RIESGO
abrir ↗Referência✓ VexDay Proof
LightBlog 8.4.1.1 - Remote Code Execution
cp_memberedit.php in LightBlog 8.4.1.1 does not check for administrative credentials when processing an admin action, wh
23RIESGO
abrir ↗Referência✓ VexDay Proof
FS4104-AW VDSL Device (Rooter) - GoAhead WebServer Disclosure
goform/QuickStart_c0 on the GoAhead Web Server on the FS4104-AW (aka rooter) VDSL device contains a password in the type
23RIESGO
abrir ↗Referência✓ VexDay Proof
Maxtrade AIO 1.3.23 - 'categori' SQL Injection
SQL injection vulnerability in the Trade module in Maxtrade AIO 1.3.23 allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗Referência✓ VexDay Proof
LiteNews 0.1 - 'id' SQL Injection
SQL injection vulnerability in index.php in LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers
23RIESGO
abrir ↗Referência✓ VexDay Proof
Macromedia Flash 8 (Flash8b.ocx) Internet Explorer 7 - Denial of Service
Flash8b.ocx in Macromedia Flash 8 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a
23RIESGO
abrir ↗Referência✓ VexDay Proof
a-ConMan 3.2b - 'common.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in common.inc.php in a-ConMan 3.2 beta allows remote attackers to execute arbitr
23RIESGO
abrir ↗Referência✓ VexDay Proof
BlazeVideo HDTV Player 3.5 - '.PLF' Playlist File Local Overflow
Stack-based buffer overflow in BlazeVideo HDTV Player 3.5 and earlier allows remote attackers to execute arbitrary code
28RIESGO
abrir ↗Referência✓ VexDay Proof
Segue CMS 1.5.8 - 'themesdir' Remote File Inclusion
PHP remote file inclusion vulnerability in themes/program/themesettings.inc.php in Segue CMS 1.5.8 and earlier, when reg
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.