Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência
CVE-2026-10250
CVE-2026-10250MEDIUM
itsourcecode Online Blood Bank Management System campsdetails.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10287
CVE-2026-10287MEDIUM
SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-10219
CVE-2026-10219MEDIUM
nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-10218
CVE-2026-10218MEDIUM
nextlevelbuilder GoClaw evolution_handlers.go auth improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-82876
CVE-2026-82876CRITICAL
Phison PS3111-S11 Controller Firmware Signature Verification Bypass
48RIESGO
abrir ↗
Referência
CVE-2026-82680
CVE-2026-82680HIGH
D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write
41RIESGO
abrir ↗
Referência
CVE-2026-82616
CVE-2026-82616CRITICAL
TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow
48RIESGO
abrir ↗
Referência
CVE-2026-82599
CVE-2026-82599MEDIUM
SeaCMS Avatar Upload member.php unlink path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-10258
CVE-2026-10258MEDIUM
itsourcecode Content Management System add_sub_topic.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10253
CVE-2026-10253MEDIUM
itsourcecode Online House Rental System manage_payment.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-10251
CVE-2026-10251MEDIUM
itsourcecode Online House Rental System ajax.php login sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
more.groupware 0.74 - 'new_calendarid' SQL Injection
CVE-2006-4906—webappsphp
SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Joomla! Component Highwood Design hwdVideoShare - SQL Injection
CVE-2008-0916—webappsphp
SQL injection vulnerability in the Highwood Design hwdVideoShare (com_hwdvideoshare) 1.1.3 Alpha component for Joomla!
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CafeEngine - Multiple SQL Injections
CVE-2008-4605—webappsphp
SQL injection vulnerability in CafeEngine allows remote attackers to execute arbitrary SQL commands via the id parameter
23RIESGO
abrir ↗
Referência
CVE-2026-9471
CVE-2026-9471MEDIUM
yashpokharna2555 StudentManagementSystem student.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-9470
CVE-2026-9470MEDIUM
yashpokharna2555 StudentManagementSystem student_trans.php confirm_logged_in sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-9469
CVE-2026-9469MEDIUM
yashpokharna2555 StudentManagementSystem success.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-9467
CVE-2026-9467MEDIUM
debugmcp mcp-debugger server.ts handleGetSourceContext path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-9466
CVE-2026-9466MEDIUM
Tiandy Easy7 Integrated Management Platform API Endpoint updateUserPassword password recovery
33RIESGO
abrir ↗
Referência✓ VexDay Proof
phpQLAdmin 2.2.7 - Multiple Remote File Inclusions
CVE-2008-1067—webappsphp
Multiple PHP remote file inclusion vulnerabilities in phpQLAdmin 2.2.7 allow remote attackers to execute arbitrary PHP c
28RIESGO
abrir ↗
Referência
CVE-2018-18416
CVE-2018-18416—
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name par
23RIESGO
abrir ↗
Referência✓ VexDay Proof
GROUP-E 1.6.41 - 'head_auth.php' Remote File Inclusion
CVE-2008-1074—webappsphp
PHP remote file inclusion vulnerability in lib/head_auth.php in GROUP-E 1.6.41 allows remote attackers to execute arbitr
35RIESGO
abrir ↗
Referência
CVE-2018-18416
CVE-2018-18416—
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name par
23RIESGO
abrir ↗
Referência
CVE-2026-109525
CVE-2026-109525MEDIUM
girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
33RIESGO
abrir ↗
Referência✓ VexDay Proof
ModernBill 4.4.x - Cross-Site Scripting / Remote File Inclusion
CVE-2008-5059—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in ModernBill 4.4 and earlier allows remote attackers to inject ar
23RIESGO
abrir ↗
Referência✓ VexDay Proof
E-Uploader Pro 1.0 - Multiple SQL Injections
CVE-2008-5075—webappsphp
Multiple SQL injection vulnerabilities in E-Uploader Pro 1.0 (aka Uploader PRO), when magic_quotes_gpc is disabled, allo
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Avahi < 0.6.24 - mDNS Daemon Remote Denial of Service
CVE-2008-5081—dosmultiple
The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 al
50RIESGO
abrir ↗
Referência✓ VexDay Proof
Orca 2.0/2.0.2 - 'params.php?gConf[dir][layouts]' Remote File Inclusion
CVE-2008-5167—webappsphp
PHP remote file inclusion vulnerability in layout/default/params.php in Boonex Orca 2.0 and 2.0.2, when register_globals
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Tips Complete Website 1.2.0 - 'tipid' SQL Injection
CVE-2008-5168—webappsphp
SQL injection vulnerability in tip.php in Tips Complete Website 1.2.0 allows remote attackers to execute arbitrary SQL c
23RIESGO
abrir ↗
Referência
CVE-2026-47114
CVE-2026-47114HIGH
IINA < 1.4.3 Command Execution via iina://open URL Scheme
41RIESGO
abrir ↗
← anteriorpágina 846 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.