Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

87.899exploits catalogados
40.763CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.463Exploit-DB 24.489GitHub PoC 18.324VulnCheck XDB 10.507Nuclei 4577Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.463 exploits
Referência✓ VexDay Proof
EgyPlus 7ml 1.0.1 - Authentication Bypass
CVE-2009-2168CRITICALwebappsphp
cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit whe
53RIESGO
abrir ↗
Referência✓ VexDay Proof
Discuz! 5.0.0 GBK - SQL Injection / Admin Credentials Disclosure
CVE-2006-5561—webappsphp
SQL injection vulnerability in admincp.php in Discuz! GBK 5.0.0 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2025-28036
CVE-2025-28036CRITICAL
TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the se
48RIESGO
abrir ↗
Referência
CVE-2025-28035
CVE-2025-28035CRITICAL
TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the set
48RIESGO
abrir ↗
Referência
CVE-2022-41403
CVE-2022-41403CRITICAL
OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at
48RIESGO
abrir ↗
Referência
CVE-2025-28034
CVE-2025-28034CRITICAL
TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.51
48RIESGO
abrir ↗
Referência✓ VexDay Proof
DigiRez 3.4 - 'book_id' SQL Injection
CVE-2007-0128—webappsasp
SQL injection vulnerability in info_book.asp in Digirez 3.4 and earlier allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2022-40877
CVE-2022-40877CRITICAL
Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.
48RIESGO
abrir ↗
Referência
CVE-2015-4669
CVE-2015-4669—
The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the sy
23RIESGO
abrir ↗
Referência
CVE-2014-9457
CVE-2014-9457—
SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users
23RIESGO
abrir ↗
Referência
CVE-2017-14126
CVE-2017-14126—
The Participants Database plugin before 1.7.5.10 for WordPress has XSS.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Basic PHP Events Lister 1.0 - SQL Injection
CVE-2008-6464—webappsphp
SQL injection vulnerability in event.php in Mevin Productions Basic PHP Events Lister 1.0 allows remote attackers to exe
23RIESGO
abrir ↗
Referência
CVE-2026-51772
CVE-2026-51772MEDIUM
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multi
33RIESGO
abrir ↗
Referência
CVE-2026-97368
CVE-2026-97368MEDIUM
chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization
33RIESGO
abrir ↗
Referência✓ VexDay Proof
LocazoList 2.01a beta5 - 'subcatID' SQL Injection
CVE-2007-0129—webappsasp
SQL injection vulnerability in main.asp in LocazoList 2.01a beta5 and earlier allows remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component live chat - SQL Injection / Open Proxy
CVE-2008-6881—webappsphp
Multiple SQL injection vulnerabilities in the Live Chat (com_livechat) component 1.0 for Joomla! allow remote attackers
23RIESGO
abrir ↗
Referência
CVE-2009-2234
CVE-2009-2234—
Multiple SQL injection vulnerabilities in admin.php in VICIDIAL Call Center Suite 2.0.5-173 allow remote attackers to ex
23RIESGO
abrir ↗
Referência✓ VexDay Proof
XOOPS Module debaser 0.92 - 'genre.php' Blind SQL Injection
CVE-2007-1805—webappsphp
SQL injection vulnerability in genre.php in the debaser 0.92 and earlier module for Xoops allows remote attackers to exe
23RIESGO
abrir ↗
Referência
CVE-2009-2308
CVE-2009-2308—
Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier fo
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component Phil-a-Form 1.2.0.0 - SQL Injection
CVE-2007-2933—webappsphp
SQL injection vulnerability in index.php in the Phil-a-Form (com_philaform) 1.2.0.0 and earlier component for Joomla! al
23RIESGO
abrir ↗
Referência
CVE-2009-3002
CVE-2009-3002—
The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows lo
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PNPHPBB2 < 1.2i - 'viewforum.php' SQL Injection
CVE-2007-3584—webappsphp
SQL injection vulnerability in viewforum.php in PNphpBB2 1.2i and earlier for Postnuke allows remote attackers to execut
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Mambo Component Remository - 'cat' SQL Injection
CVE-2007-4505—webappsphp
SQL injection vulnerability in index.php in the RemoSitory component (com_remository) for Mambo allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2007-5817
CVE-2007-5817MEDIUM
dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to perform certain privileged actions via a (1
33RIESGO
abrir ↗
Referência✓ VexDay Proof
JBC Explorer 7.20 RC 1 - Remote Code Execution
CVE-2007-5914—webappsphp
Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WebPortal CMS 0.7.4 - 'download.php' SQL Injection
CVE-2008-4345—webappsphp
SQL injection vulnerability in download.php in WebPortal CMS 0.7.4 and earlier allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Injader CMS 2.1.1 - 'id' SQL Injection
CVE-2008-5890—webappsphp
SQL injection vulnerability in feeds.php in Injader before 2.1.2 allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2009-5091
CVE-2009-5091—
SQL injection vulnerability in page.php in Vlinks 1.0.3 and 1.1.6 allows remote attackers to execute arbitrary SQL comma
23RIESGO
abrir ↗
Referência
CVE-2009-2396
CVE-2009-2396—
PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress p
23RIESGO
abrir ↗
Referência
CVE-2009-4140
CVE-2009-4140—
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer
60RIESGO
abrir ↗
← anteriorpágina 773 / 883siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.