Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2017-17581
CVE-2017-17581—
FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-15986
CVE-2017-15986—
CPA Lead Reward Script allows SQL Injection via the username parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17583
CVE-2017-17583—
FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17583
CVE-2017-17583—
FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17584
CVE-2017-17584—
FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Linux Kernel 2.6.17 < 2.6.24.1 - 'vmsplice' Local Privilege Escalation (2)
CVE-2008-0600—locallinux
The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo
23RIESGO
abrir ↗
Referência
CVE-2017-17576
CVE-2017-17576—
FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or se
23RIESGO
abrir ↗
Referência
CVE-2017-17578
CVE-2017-17578—
FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.
23RIESGO
abrir ↗
Referência
CVE-2021-40379
CVE-2021-40379—
An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 doe
28RIESGO
abrir ↗
Referência
CVE-2015-1389
CVE-2015-1389—
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote at
23RIESGO
abrir ↗
Referência
CVE-2026-78057
CVE-2026-78057MEDIUM
sambitraj Student-Management-System Management Mutation sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-78051
CVE-2026-78051MEDIUM
alexta69 MeTube Cookie File cookies.txt file access
33RIESGO
abrir ↗
Referência
CVE-2026-78050
CVE-2026-78050CRITICAL
Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow
48RIESGO
abrir ↗
Referência
CVE-2015-1518
CVE-2015-1518—
SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before 2.3.0 allows remote
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Update 2.7 - '/admin/uploads.php' Remote Code Execution
CVE-2006-6879—webappsphp
Unrestricted file upload vulnerability in admin/uploads.php in PHP-Update 2.7 and earlier allows remote authenticated us
23RIESGO
abrir ↗
Referência
CVE-2017-15971
CVE-2017-15971—
Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php send
23RIESGO
abrir ↗
Referência✓ VexDay Proof
File Store PRO 3.2 - Multiple Blind SQL Injections
CVE-2006-1278—webappsphp
SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via th
23RIESGO
abrir ↗
Referência
CVE-2026-77002
CVE-2026-77002CRITICAL
SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass
48RIESGO
abrir ↗
Referência
CVE-2026-77001
CVE-2026-77001CRITICAL
Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass
48RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP iCalendar 2.21 - 'publish.ical.php' Remote Code Execution
CVE-2006-1291—webappsphp
publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write acce
23RIESGO
abrir ↗
Referência
CVE-2026-70667
CVE-2026-70667MEDIUM
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
33RIESGO
abrir ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALbajo ataque
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RIESGO
abrir ↗
Referência
CVE-2017-17605
CVE-2017-17605—
Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17609
CVE-2017-17609—
Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2026-15215
CVE-2026-15215HIGH
Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation
41RIESGO
abrir ↗
Referência
CVE-2026-19049
CVE-2026-19049HIGH
ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie
41RIESGO
abrir ↗
Referência
CVE-2020-14882
CVE-2020-14882CRITICALbajo ataque
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Arab Portal 2.1 (Windows) - Remote File Disclosure
CVE-2008-5787—webappsphp
Directory traversal vulnerability in mod.php in Arab Portal 2.1 on Windows allows remote attackers to read arbitrary fil
23RIESGO
abrir ↗
Referência
CVE-2020-14882
CVE-2020-14882CRITICALbajo ataque
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RIESGO
abrir ↗
Referência
CVE-2026-16595
CVE-2026-16595MEDIUM
WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure
33RIESGO
abrir ↗
← anteriorpágina 812 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.