Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.853exploits catalogados
39.383CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
25.447 exploits
Referência✓ VexDay Proof
phpGreetCards - Cross-Site Scripting / Arbitrary File Upload
Cross-site scripting (XSS) vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to inject arbitrary w
23RIESGO
abrir ↗Referência✓ VexDay Proof
Joomla! Component Ice Gallery 0.5b2 - 'catid' Blind SQL Injection
SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to exe
23RIESGO
abrir ↗Referência
CVE-2026-56121
Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization
48RIESGO
abrir ↗Referência✓ VexDay Proof
Absolute News Feed 1.0 - Remote Insecure Cookie Handling
Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain adminis
23RIESGO
abrir ↗Referência
CVE-2026-7669
sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection
33RIESGO
abrir ↗Referência
CVE-2026-7669
sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection
33RIESGO
abrir ↗Referência
CVE-2026-7672
youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injection
33RIESGO
abrir ↗Referência
CVE-2026-7384
ezequiroga mcp-bases research_server.py search_papers path traversal
33RIESGO
abrir ↗Referência
CVE-2026-7671
CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication
33RIESGO
abrir ↗Referência
CVE-2026-7668
MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds
33RIESGO
abrir ↗Referência
CVE-2026-7653
r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection
33RIESGO
abrir ↗Referência
CVE-2026-56111
Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler
41RIESGO
abrir ↗Referência
CVE-2026-55200
libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
48RIESGO
abrir ↗Referência
CVE-2010-5009
SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗Referência✓ VexDay Proof
Beryo 2.0 - 'downloadpic.php?chemin' Remote File Disclosure
Directory traversal vulnerability in downloadpic.php in Beryo 2.0, and possibly other versions including 2.4, allows rem
23RIESGO
abrir ↗Referência✓ VexDay Proof
PcP-Guestbook 3.0 - 'lang' Local File Inclusion
Multiple directory traversal vulnerabilities in PcP-Guestbook (PcP-Book) 3.0 allow remote attackers to include and execu
23RIESGO
abrir ↗Referência
CVE-2026-9815
MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE
33RIESGO
abrir ↗Referência✓ VexDay Proof
Prediction Football 1.x - 'matchid' SQL Injection
SQL injection vulnerability in showpredictionsformatch.php in Prediction Football 1.x allows remote attackers to execute
23RIESGO
abrir ↗Referência✓ VexDay Proof
Linux Kernel < 2.6.26.4 - SCTP Kernel Memory Disclosure
The sctp_getsockopt_hmac_ident function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implemen
23RIESGO
abrir ↗Referência
CVE-2021-22502
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The
100RIESGO
abrir ↗Referência
CVE-2025-20281
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
100RIESGO
abrir ↗Referência✓ VexDay Proof
ForumApp 3.3 - Remote Database Disclosure
ForumApp 3.3 stores sensitive information under the web root with insufficient access control, which allows remote attac
23RIESGO
abrir ↗Referência✓ VexDay Proof
Absolute Control Panel XE 1.5 - Insecure Cookie Handling
Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative ac
23RIESGO
abrir ↗Referência✓ VexDay Proof
merlix educate servert - Authentication Bypass / File Disclosure
Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information
23RIESGO
abrir ↗Referência
CVE-2020-25223
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511
100RIESGO
abrir ↗Referência✓ VexDay Proof
Joomla! Component Content 1.0.0 - 'itemID' SQL Injection
SQL injection vulnerability in the content component (com_content) 1.0.0 for Joomla! allows remote attackers to execute
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHPStore Real Estate - Arbitrary File Upload
Unrestricted file upload vulnerability in PHPStore Real Estate allows remote authenticated users to execute arbitrary co
23RIESGO
abrir ↗Referência✓ VexDay Proof
pl-PHP Beta 0.9 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in login.php in pL-PHP beta 0.9 allow remote attackers to execute arbitrary SQL c
23RIESGO
abrir ↗Referência
CVE-2008-4178
SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and D
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.