Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.899exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.463 exploits
Referência✓ VexDay Proof
k_shoutbox 4.4 - Remote File Inclusion
CVE-2006-3989—webappsphp
PHP remote file inclusion vulnerability in index.php in Knusperleicht Shoutbox 4.4 and earlier allows remote attackers t
23RIESGO
abrir ↗
Referência
CVE-2026-19009
CVE-2026-19009MEDIUM
TinyAGI Message API Endpoint response.ts collectFiles file inclusion
33RIESGO
abrir ↗
Referência
CVE-2026-87924
CVE-2026-87924MEDIUM
Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-87923
CVE-2026-87923MEDIUM
Rizwan17 inventory-management-system List DBOperation.php cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection
CVE-2008-4772—webappsphp
SQL injection vulnerability in main/main.php in QuestCMS allows remote attackers to execute arbitrary SQL commands via t
23RIESGO
abrir ↗
Referência
CVE-2011-4831
CVE-2011-4831—
Directory traversal vulnerability in webFileBrowser.php in Web File Browser 0.4b14 allows remote authenticated users to
23RIESGO
abrir ↗
Referência
CVE-2026-10690
CVE-2026-10690MEDIUM
wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2009-3208
CVE-2009-3208—
Multiple SQL injection vulnerabilities in phpfreeBB 1.0 allow remote attackers to execute arbitrary SQL commands via the
23RIESGO
abrir ↗
Referência
CVE-2026-10583
CVE-2026-10583MEDIUM
nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2017-17620
CVE-2017-17620—
Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2009-4726
CVE-2009-4726—
Directory traversal vulnerability in download.php in Quickdev 4 PHP allows remote attackers to read arbitrary files via
23RIESGO
abrir ↗
Referência
CVE-2026-93956
CVE-2026-93956MEDIUM
olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting
33RIESGO
abrir ↗
Referência
Tatsu 3.3.11 - Unauthenticated RCE
CVE-2021-25094—webappsphp
Tatsu < 3.3.12 - Unauthenticated RCE
60RIESGO
abrir ↗
Referência
CVE-2021-25155
CVE-2021-25155—
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v
28RIESGO
abrir ↗
Referência✓ VexDay Proof
RunCMS 1.6 - Multiple Vulnerabilities
CVE-2007-6547—webappsphp
RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Fusion Mod freshlinks - 'linkid' SQL Injection
CVE-2008-5074—webappsphp
SQL injection vulnerability in index.php in the Freshlinks 1.0 RC1 module for PHP-Fusion allows remote attackers to exec
23RIESGO
abrir ↗
Referência
CVE-2026-18787
CVE-2026-18787HIGH
GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection
41RIESGO
abrir ↗
Referência
CVE-2026-86514
CVE-2026-86514MEDIUM
vgmstream txth-txtp txth.c sscanf stack-based overflow
33RIESGO
abrir ↗
Referência
CVE-2011-5110
CVE-2011-5110—
Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQ
23RIESGO
abrir ↗
Referência
CVE-2026-92796
CVE-2026-92796HIGH
Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass
41RIESGO
abrir ↗
Referência
CVE-2026-19845
CVE-2026-19845HIGH
TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
41RIESGO
abrir ↗
Referência
CVE-2010-3467
CVE-2010-3467—
SQL injection vulnerability in modules/sections/index.php in E-Xoopport Samsara 3.1 and earlier, when the Tutorial modul
23RIESGO
abrir ↗
Referência
CVE-2026-32847
CVE-2026-32847HIGH
DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py
21RIESGO
abrir ↗
Referência
CVE-2010-4249
CVE-2010-4249—
The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properl
23RIESGO
abrir ↗
Referência
CVE-2018-0710
CVE-2018-0710—
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authe
28RIESGO
abrir ↗
Referência
CVE-2018-0710
CVE-2018-0710—
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authe
28RIESGO
abrir ↗
Referência
CVE-2026-18200
CVE-2026-18200MEDIUM
FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update
33RIESGO
abrir ↗
Referência
CVE-2026-86318
CVE-2026-86318MEDIUM
java-json-tools json-patch JsonMergePatchDeserializer.java JsonMergePatch.fromJson stack-based overflow
33RIESGO
abrir ↗
Referência
CVE-2010-3483
CVE-2010-3483—
cms_write.php in Primitive CMS 1.0.9 does not properly restrict access, which allows remote attackers to gain administra
23RIESGO
abrir ↗
Referência
CVE-2010-4272
CVE-2010-4272—
SQL injection vulnerability in the Pulse Infotech Sponsor Wall (com_sponsorwall) component 1.1 for Joomla! allows remote
23RIESGO
abrir ↗
← anteriorpágina 770 / 883siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.