Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência✓ VexDay Proof
shibby shop 2.2 - Multiple Vulnerabilities
CVE-2008-2882—webappsphp
upgrade.asp in sHibby sHop 2.2 and earlier does not require administrative authentication, which allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2026-19715
CVE-2026-19715HIGH
WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
41RIESGO
abrir ↗
Referência
CVE-2026-106099
CVE-2026-106099MEDIUM
WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
33RIESGO
abrir ↗
Referência
CVE-2026-9584
CVE-2026-9584MEDIUM
code-projects Project Management System Login chk.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-105975
CVE-2026-105975MEDIUM
CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
33RIESGO
abrir ↗
Referência
CVE-2026-103307
CVE-2026-103307HIGH
Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Dana IRC 1.3 - Remote Buffer Overflow (PoC)
CVE-2008-2922—doswindows
Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of serv
23RIESGO
abrir ↗
Referência
CVE-2014-5207
CVE-2014-5207—
fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOE
23RIESGO
abrir ↗
Referência
CVE-2013-1605
CVE-2013-1605—
Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitra
28RIESGO
abrir ↗
Referência
CVE-2026-8289
CVE-2026-8289MEDIUM
Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service
33RIESGO
abrir ↗
Referência
CVE-2024-25735
CVE-2024-25735CRITICAL
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext password
75RIESGO
abrir ↗
Referência
CVE-2013-3214
CVE-2013-3214—
vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
60RIESGO
abrir ↗
Referência
CVE-2012-2591
CVE-2012-2591—
Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attack
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
CVE-2008-3117—webappsphp
Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated us
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
CVE-2008-3118—webappsphp
SQL injection vulnerability in play.php in PHPmotion 2.0 and earlier allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Mole Group Hotel Script 1.0 - SQL Injection
CVE-2008-3124—webappsphp
SQL injection vulnerability in index.php in Mole Group Hotel Script 1.0 allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2014-5301
CVE-2014-5301—
Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 t
60RIESGO
abrir ↗
Referência
CVE-2012-2924
CVE-2012-2924—
PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attacker
23RIESGO
abrir ↗
Referência
CVE-2026-6186
CVE-2026-6186HIGH
UTT HiPER 1200GW formNatStaticMap strcpy buffer overflow
41RIESGO
abrir ↗
Referência
CVE-2014-5464
CVE-2014-5464—
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 al
23RIESGO
abrir ↗
Referência
CVE-2014-6037
CVE-2014-6037—
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
60RIESGO
abrir ↗
Referência✓ VexDay Proof
TWiki 4.2.0 - 'configure' Remote File Disclosure
CVE-2008-3195—webappscgi
Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide
23RIESGO
abrir ↗
Referência✓ VexDay Proof
AuraCMS 2.2.2 - '/pages_data.php' Arbitrary Edit/Add/Delete
CVE-2008-3203—webappsphp
js/pages/pages_data.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Ultrastats 0.2.142 - 'players-detail.php' Blind SQL Injection
CVE-2008-3241—webappsphp
SQL injection vulnerability in players-detail.php in UltraStats 0.2.136, 0.2.140, and 0.2.142 allows remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2026-5633
CVE-2026-5633MEDIUM
assafelovic gpt-researcher ws Endpoint server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2018-25235
CVE-2018-25235MEDIUM
NetworkActiv Web Server 4.0 Username Field Buffer Overflow DoS
33RIESGO
abrir ↗
Referência
CVE-2026-5330
CVE-2026-5330MEDIUM
SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control
33RIESGO
abrir ↗
Referência
CVE-2026-5328
CVE-2026-5328MEDIUM
shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-5327
CVE-2026-5327MEDIUM
efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection
33RIESGO
abrir ↗
Referência
CVE-2026-5326
CVE-2026-5326MEDIUM
SourceCodester Leave Application System User Information index.php authorization
33RIESGO
abrir ↗
← anteriorpágina 797 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.