Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.052exploits catalogados

40.803CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.494Exploit-DB 24.489GitHub PoC 18.347VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientes populares riesgo

26.494 exploits

Referência✓ VexDay Proof

aeDating 4.1 - dir[inc] Remote File Inclusion

CVE-2006-4870—webappsphp

Multiple PHP remote file inclusion vulnerabilities in AEDating 4.1, and possibly earlier versions, allow remote attacker

28RIESGO

abrir ↗

Referência

CVE-2026-82921

CVE-2026-82921MEDIUM

ShopEx ECShop pack.php check_img_type unrestricted upload

33RIESGO

abrir ↗

Referência

CVE-2026-34107

CVE-2026-34107CRITICAL

Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php

48RIESGO

abrir ↗

Referência

CVE-2012-2275

CVE-2012-2275—

Multiple cross-site request forgery (CSRF) vulnerabilities in TestLink 1.9.3 and earlier allow remote attackers to hijac

23RIESGO

abrir ↗

Referência

CVE-2026-82545

CVE-2026-82545MEDIUM

itsourcecode Sales and Inventory System sup_searchfrm.php sql injection

33RIESGO

abrir ↗

Referência✓ VexDay Proof

Joomla! Component EXP Shop - 'catid' SQL Injection

CVE-2008-2892—webappsphp

SQL injection vulnerability in the EXP Shop (com_expshop) component 1.0 for Joomla! allows remote attackers to execute a

23RIESGO

abrir ↗

Referência

CVE-2024-0737

CVE-2024-0737MEDIUM

Xlightftpd Xlight FTP Server Login denial of service

33RIESGO

abrir ↗

Referência

CVE-2013-1605

CVE-2013-1605—

Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitra

28RIESGO

abrir ↗

Referência

CVE-2026-8289

CVE-2026-8289MEDIUM

Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service

33RIESGO

abrir ↗

Referência

CVE-2024-25735

CVE-2024-25735CRITICAL

An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext password

75RIESGO

abrir ↗

Referência

CVE-2013-3214

CVE-2013-3214—

vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.

60RIESGO

abrir ↗

Referência

CVE-2012-2591

CVE-2012-2591—

Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attack

23RIESGO

abrir ↗

Referência✓ VexDay Proof

PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload

CVE-2008-3117—webappsphp

Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated us

23RIESGO

abrir ↗

Referência✓ VexDay Proof

PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload

CVE-2008-3118—webappsphp

SQL injection vulnerability in play.php in PHPmotion 2.0 and earlier allows remote attackers to execute arbitrary SQL co

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Mole Group Hotel Script 1.0 - SQL Injection

CVE-2008-3124—webappsphp

SQL injection vulnerability in index.php in Mole Group Hotel Script 1.0 allows remote attackers to execute arbitrary SQL

23RIESGO

abrir ↗

Referência

CVE-2014-5301

CVE-2014-5301—

Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 t

60RIESGO

abrir ↗

Referência

CVE-2012-2924

CVE-2012-2924—

PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attacker

23RIESGO

abrir ↗

Referência

CVE-2026-6186

CVE-2026-6186HIGH

UTT HiPER 1200GW formNatStaticMap strcpy buffer overflow

41RIESGO

abrir ↗

Referência

CVE-2014-5464

CVE-2014-5464—

Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 al

23RIESGO

abrir ↗

Referência

CVE-2014-6037

CVE-2014-6037—

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8

60RIESGO

abrir ↗

Referência✓ VexDay Proof

TWiki 4.2.0 - 'configure' Remote File Disclosure

CVE-2008-3195—webappscgi

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide

23RIESGO

abrir ↗

Referência✓ VexDay Proof

AuraCMS 2.2.2 - '/pages_data.php' Arbitrary Edit/Add/Delete

CVE-2008-3203—webappsphp

js/pages/pages_data.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to a

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Ultrastats 0.2.142 - 'players-detail.php' Blind SQL Injection

CVE-2008-3241—webappsphp

SQL injection vulnerability in players-detail.php in UltraStats 0.2.136, 0.2.140, and 0.2.142 allows remote attackers to

23RIESGO

abrir ↗

Referência

CVE-2026-5633

CVE-2026-5633MEDIUM

assafelovic gpt-researcher ws Endpoint server-side request forgery

33RIESGO

abrir ↗

Referência

CVE-2026-5330

CVE-2026-5330MEDIUM

SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control

33RIESGO

abrir ↗

Referência

CVE-2026-5328

CVE-2026-5328MEDIUM

shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection

33RIESGO

abrir ↗

Referência

CVE-2026-5327

CVE-2026-5327MEDIUM

efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection

33RIESGO

abrir ↗

Referência

CVE-2026-5326

CVE-2026-5326MEDIUM

SourceCodester Leave Application System User Information index.php authorization

33RIESGO

abrir ↗

Referência

CVE-2026-5325

CVE-2026-5325MEDIUM

SourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting

33RIESGO

abrir ↗

Referência

CVE-2026-5259

CVE-2026-5259MEDIUM

AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery

33RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.