Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2022-30525
CVE-2022-30525CRITICALbajo ataque
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RIESGO
abrir ↗
Referência
CVE-2026-38638
CVE-2026-38638HIGH
An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Servic
41RIESGO
abrir ↗
Referência✓ VexDay Proof
Web3news 0.95 - 'PHPSECURITYADMIN_PATH' Remote File Inclusion
CVE-2006-4452—webappsphp
PHP remote file inclusion vulnerability in security/include/_class.security.php in Web3news 0.95 and earlier, when regis
23RIESGO
abrir ↗
Referência
CVE-2026-38636
CVE-2026-38636HIGH
An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Servic
41RIESGO
abrir ↗
Referência
CVE-2026-81836
CVE-2026-81836MEDIUM
RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission
33RIESGO
abrir ↗
Referência
CVE-2017-17608
CVE-2017-17608—
Child Care Script 1.0 has SQL Injection via the /list city parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Interact 2.2 - 'CONFIG[base_path]' Remote File Inclusion
CVE-2006-4448—webappsphp
Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow remote attac
23RIESGO
abrir ↗
Referência
CVE-2017-17613
CVE-2017-17613—
Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php cati
23RIESGO
abrir ↗
Referência
CVE-2017-17614
CVE-2017-17614—
Food Order Script 1.0 has SQL Injection via the /list city parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-17616
CVE-2017-17616—
Event Search Script 1.0 has SQL Injection via the /event-list city parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
InoutMailingListManager 3.1 - Remote Command Execution
CVE-2007-2004—webappsphp
Multiple SQL injection vulnerabilities in InoutMailingListManager 3.1 and earlier allow remote attackers to execute arbi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Mambo Component com_yanc 1.4 Beta - 'id' SQL Injection
CVE-2007-2792—webappsphp
SQL injection vulnerability in the Yet another Newsletter Component (aka YaNC or com_yanc) component before 1.5 beta 3 f
23RIESGO
abrir ↗
Referência
CVE-2026-75986
CVE-2026-75986MEDIUM
code-projects Online Job Portal System Password Recovery ForPass.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2018-12653
CVE-2018-12653—
A Reflected Cross Site Scripting (XSS) vulnerability exists in Adrenalin HRMS 5.4.0. An attacker can input malicious Jav
23RIESGO
abrir ↗
Referência
CVE-2026-75979
CVE-2026-75979MEDIUM
xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine
33RIESGO
abrir ↗
Referência
CVE-2026-16127
CVE-2026-16127MEDIUM
zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-101188
CVE-2026-101188MEDIUM
Netcore POWER13 ubus routerd.passwd_set password recovery
33RIESGO
abrir ↗
Referência
CVE-2026-16492
CVE-2026-16492MEDIUM
umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-16016
CVE-2026-16016MEDIUM
poco-ai poco-claw task.py run_task server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2019-0552
CVE-2019-0552—
An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability."
23RIESGO
abrir ↗
Referência
CVE-2026-101187
CVE-2026-101187CRITICAL
Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection
48RIESGO
abrir ↗
Referência
CVE-2026-93355
CVE-2026-93355HIGH
LiteLLM Weak JWT Authentication via Email-Based User Lookup
41RIESGO
abrir ↗
Referência
CVE-2026-101076
CVE-2026-101076CRITICAL
Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection
48RIESGO
abrir ↗
Referência
CVE-2018-12908
CVE-2018-12908—
Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensiti
28RIESGO
abrir ↗
Referência✓ VexDay Proof
WordPress Plugin Sniplets 1.1.2 - Remote File Inclusion / Cross-Site Scripting / Remote Code Execution
CVE-2008-1059—webappsphp
PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordP
50RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPOracleView - 'include_all.inc.php?page_dir' Remote File Inclusion
CVE-2007-2340—webappsphp
Multiple PHP remote file inclusion vulnerabilities in inc/include_all.inc.php in phporacleview allow remote attackers to
35RIESGO
abrir ↗
Referência
CVE-2017-3623
CVE-2017-3623—
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). For supported ve
28RIESGO
abrir ↗
Referência
CVE-2019-1821
CVE-2019-1821HIGH
Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
78RIESGO
abrir ↗
Referência
CVE-2017-3881
CVE-2017-3881CRITICALbajo ataque
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co
100RIESGO
abrir ↗
Referência
CVE-2019-25752
CVE-2019-25752HIGH
Joomla! Component J-BusinessDirectory 4.9.7 SQL Injection
41RIESGO
abrir ↗
← anteriorpágina 828 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.