Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2019-6340
CVE-2019-6340HIGHbajo ataque
Drupal core - Highly critical - Remote Code Execution
100RIESGO
abrir ↗
Referência
CVE-2026-92460
CVE-2026-92460HIGH
yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
41RIESGO
abrir ↗
Referência
CVE-2026-85397
CVE-2026-85397MEDIUM
code-projects Hospital Information System addReq.php findBySearch sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14562
CVE-2026-14562MEDIUM
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure
33RIESGO
abrir ↗
Referência
CVE-2026-14560
CVE-2026-14560CRITICAL
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
48RIESGO
abrir ↗
Referência
CVE-2025-15485
CVE-2025-15485HIGH
Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call
41RIESGO
abrir ↗
Referência✓ VexDay Proof
IntelliTamper 2.07 - '.map' Local Arbitrary Code Execution (1)
CVE-2006-2494—localwindows
Stack-based buffer overflow in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a crafted .map f
23RIESGO
abrir ↗
Referência
CVE-2026-92466
CVE-2026-92466HIGH
microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
41RIESGO
abrir ↗
Referência
CVE-2026-14559
CVE-2026-14559CRITICAL
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover
48RIESGO
abrir ↗
Referência
CVE-2025-15481
CVE-2025-15481MEDIUM
Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure
33RIESGO
abrir ↗
Referência
CVE-2024-3773
CVE-2024-3773MEDIUM
LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode
33RIESGO
abrir ↗
Referência
CVE-2019-8923
CVE-2019-8923—
XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discont
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Surgemail 38k - 'Search' Remote Buffer Overflow
CVE-2007-4377—remotewindows
Stack-based buffer overflow in the IMAP service in SurgeMail 38k allows remote authenticated users to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2026-81934
CVE-2026-81934HIGH
Redis TLS pending-data list use-after-free
41RIESGO
abrir ↗
Referência
CVE-2020-0618
CVE-2020-0618CRITICALbajo ataqueransomware
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page
100RIESGO
abrir ↗
Referência
CVE-2020-0618
CVE-2020-0618CRITICALbajo ataqueransomware
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page
100RIESGO
abrir ↗
Referência
CVE-2026-15381
CVE-2026-15381LOW
WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter
28RIESGO
abrir ↗
Referência✓ VexDay Proof
DL PayCart 1.01 - 'viewitem.php?ItemID' Blind SQL Injection
CVE-2007-4604—webappsphp
SQL injection vulnerability in viewitem.php in DL PayCart 1.01 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2026-16569
CVE-2026-16569MEDIUM
ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update
33RIESGO
abrir ↗
Referência
CVE-2026-13392
CVE-2026-13392HIGH
ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Epistemon 1.0 - 'common.php?inc_path' Remote File Inclusion
CVE-2007-0701—webappsphp
PHP remote file inclusion vulnerability in inc/common.inc.php in Epistemon 1.0 allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2026-12720
CVE-2026-12720HIGH
Kirki < 6.0.13 - Unauthenticated PHP Object Injection
41RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPNuke-Clan 4.2.0 - 'mvcw_conver.php' Remote File Inclusion
CVE-2007-4606—webappsphp
PHP remote file inclusion vulnerability in convert/mvcw_conver.php in the Virtual War (VWar) module for PHPNuke-Clan (PN
23RIESGO
abrir ↗
Referência
AirDroid 4.2.1.6 - Denial of Service
CVE-2019-9599—dosandroid
The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash
28RIESGO
abrir ↗
Referência
MCL-Net 4.3.5.8788 - Information Disclosure
CVE-2023-34834—webappshardware
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attacker
23RIESGO
abrir ↗
Referência
CVE-2017-6527
CVE-2017-6527—
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal att
50RIESGO
abrir ↗
Referência✓ VexDay Proof
DoceboLms 2.0.5 - 'help.php' Remote File Inclusion
CVE-2006-2668—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP co
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Ottoman CMS 1.1.3 - '?default_path=' Remote File Inclusion (1)
CVE-2006-2767—webappsphp
PHP remote file inclusion vulnerability in Ottoman 1.1.2, when register_globals is enabled, allows remote attackers to e
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpCommunityCalendar 4.0.3 - Cross-Site Scripting / SQL Injection
CVE-2006-2798—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to inject arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
News Bin Pro 5.33 - '.nbi' Local Buffer Overflow
CVE-2007-1074—localwindows
Multiple buffer overflows in NewsBin Pro 5.33 and NewsBin Pro 4.x allow user-assisted remote attackers to execute arbitr
23RIESGO
abrir ↗
← anteriorpágina 823 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.