Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência✓ VexDay Proof
PHP Links 1.3 - 'id' SQL Injection
SQL injection vulnerability in vote.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arb
23RIESGO
abrir ↗Referência
CVE-2017-9101
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User
60RIESGO
abrir ↗Referência
CVE-2018-12055
Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.ph
23RIESGO
abrir ↗Referência✓ VexDay Proof
VistaBB 2.x - 'functions_mod_user.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in VistaBB 2.0.33 and earlier allow remote attackers to execute arbit
23RIESGO
abrir ↗Referência
CVE-2018-17394
SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter.
23RIESGO
abrir ↗Referência✓ VexDay Proof
ProManager 0.73 - 'note.php' SQL Injection
SQL injection vulnerability in note.php in ProManager 0.73 allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗Referência
CVE-2018-17397
SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.
23RIESGO
abrir ↗Referência✓ VexDay Proof
AlberT-EasySite 1.0a5 - 'PSA_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in AES/modules/auth/phpsecurityadmin/include/logout.php in AlberT-EasySite (AES)
23RIESGO
abrir ↗Referência✓ VexDay Proof
Mambo Component com_downloads - SQL Injection
SQL injection vulnerability in index.php in the Downloads (com_downloads) component for Mambo and Joomla! allows remote
23RIESGO
abrir ↗Referência
CVE-2019-0232
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RIESGO
abrir ↗Referência
CVE-2026-107271
Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
33RIESGO
abrir ↗Referência
CVE-2026-95210
GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an A
13RIESGO
abrir ↗Referência
CVE-2020-8425
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.
23RIESGO
abrir ↗Referência
CVE-2026-105193
Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash
33RIESGO
abrir ↗Referência
CVE-2018-18797
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RIESGO
abrir ↗Referência
CVE-2026-107270
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
41RIESGO
abrir ↗Referência
CVE-2026-107181
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
41RIESGO
abrir ↗Referência✓ VexDay Proof
Joomla! Component com_Marketplace 1.1.1 - SQL Injection
SQL injection vulnerability in index.php in the Marketplace (com_marketplace) 1.1.1 and 1.1.1-pl1 component for Joomla!
23RIESGO
abrir ↗Referência
CVE-2017-9769
A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpe
60RIESGO
abrir ↗Referência
CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗Referência
CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗Referência
CVE-2020-10385
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.
23RIESGO
abrir ↗Referência
PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution
admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Exe
28RIESGO
abrir ↗Referência✓ VexDay Proof
Omnistar Article Manager Software - 'article.php' SQL Injection
SQL injection vulnerability in article.php in OmniStar Article Manager allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗Referência
CVE-2020-9375
TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a
28RIESGO
abrir ↗Referência
PHPKB Multi-Language 9 - Authenticated Directory Traversal
Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files
23RIESGO
abrir ↗Referência
CVE-2008-0722
Cross-site scripting (XSS) vulnerability in index.php in Pagetool 1.0.7 allows remote attackers to inject arbitrary web
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.