Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência✓ VexDay Proof
ProfileCMS 1.0 - Arbitrary File Upload
CVE-2007-5720—webappsphp
Unrestricted file upload vulnerability in the profiles script in ProfileCMS 1.0 allows remote attackers to upload and ex
23RIESGO
abrir ↗
Referência
CVE-2020-14864
CVE-2020-14864HIGHbajo ataque
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins
100RIESGO
abrir ↗
Referência
CVE-2026-85040
CVE-2026-85040MEDIUM
ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection
33RIESGO
abrir ↗
Referência
CVE-2023-3844
CVE-2023-3844LOW
mooSocial mooDating URL friends cross site scripting
43RIESGO
abrir ↗
Referência
CVE-2019-0708
CVE-2019-0708CRITICALbajo ataqueransomware
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RIESGO
abrir ↗
Referência
CVE-2026-101000
CVE-2026-101000CRITICAL
Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization
48RIESGO
abrir ↗
Referência
CVE-2018-0970
CVE-2018-0970—
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informatio
23RIESGO
abrir ↗
Referência
CVE-2018-0973
CVE-2018-0973—
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informatio
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPCOIN 1.2.3 - 'session_set.php' Remote File Inclusion
CVE-2006-4424—webappsphp
PHP remote file inclusion vulnerability in coin_includes/constants.php in phpCOIN 1.2.3 allows remote attackers to execu
23RIESGO
abrir ↗
Referência
CVE-2023-4407
CVE-2023-4407MEDIUM
Codecanyon Credit Lite POST Request account_statement sql injection
33RIESGO
abrir ↗
Referência
Joomla! Component JEXTN Classified 1.0.0 - 'sid' SQL Injection
CVE-2018-6575—webappsphp
SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request.
23RIESGO
abrir ↗
Referência
CVE-2026-14939
CVE-2026-14939MEDIUM
Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import
33RIESGO
abrir ↗
Referência
CVE-2026-14872
CVE-2026-14872MEDIUM
Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter
33RIESGO
abrir ↗
Referência
CVE-2020-20277
CVE-2020-20277—
There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server ver
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! / Mambo Component rsgallery 2.0b5 - 'catid' SQL Injection
CVE-2007-6362—webappsphp
SQL injection vulnerability in index.php in the RSGallery (com_rsgallery) 2.0 beta 5 and earlier component for Mambo and
23RIESGO
abrir ↗
Referência✓ VexDay Proof
SineCMS 2.3.4 - Calendar SQL Injection
CVE-2007-6366—webappsphp
Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL comm
23RIESGO
abrir ↗
Referência
CVE-2026-16767
CVE-2026-16767MEDIUM
Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-108158
CVE-2026-108158HIGH
plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert
41RIESGO
abrir ↗
Referência
CVE-2026-108112
CVE-2026-108112MEDIUM
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-108111
CVE-2026-108111MEDIUM
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search
33RIESGO
abrir ↗
Referência
CVE-2026-108110
CVE-2026-108110HIGH
MOVO through 0.2.3 Authorization Bypass via Document Endpoints
41RIESGO
abrir ↗
Referência
CVE-2026-65694
CVE-2026-65694HIGH
Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController
56RIESGO
abrir ↗
Referência
CVE-2026-12082
CVE-2026-12082HIGH
Praison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure)
41RIESGO
abrir ↗
Referência
CVE-2026-12978
CVE-2026-12978HIGH
FunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form
41RIESGO
abrir ↗
Referência✓ VexDay Proof
ZenPhoto 1.1.3 - 'rss.php?albumnr' SQL Injection
CVE-2007-6666—webappsphp
SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Webmin 1.962 - 'Package Updates' Escape Bypass RCE (Metasploit)
CVE-2020-35606—webappslinux
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can ex
28RIESGO
abrir ↗
Referência
CVE-2018-5701
CVE-2018-5701—
In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerabi
28RIESGO
abrir ↗
Referência
In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection
CVE-2021-27828—webappsmultiple
SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the a
28RIESGO
abrir ↗
Referência✓ VexDay Proof
AlkalinePHP 0.80.00 Beta - 'thread.php' SQL Injection
CVE-2008-2395—webappsphp
SQL injection vulnerability in thread.php in AlkalinePHP 0.80.00 beta and earlier allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência
CVE-2025-15700
CVE-2025-15700HIGH
AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import
41RIESGO
abrir ↗
← anteriorpágina 837 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.