Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

88.056exploits catalogados
40.804CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.494Exploit-DB 24.489GitHub PoC 18.351VulnCheck XDB 10.605Nuclei 4578Metasploit 3539✓ solo verificadosrecientespopularesriesgo
26.494 exploits
Referência✓ VexDay Proof
JV2 Folder Gallery 3.0 - 'download.php' Remote File Disclosure
CVE-2007-0329—webappsphp
download.php in Joonas Viljanen JV2 Folder Gallery allows remote attackers to read sensitive files via a relative pathna
23RIESGO
abrir ↗
Referência
CVE-2026-85128
CVE-2026-85128HIGH
Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request
41RIESGO
abrir ↗
Referência
CVE-2022-37061
CVE-2022-37061—
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This
60RIESGO
abrir ↗
Referência✓ VexDay Proof
Microsoft Windows - '.png' IHDR Block Denial of Service (PoC) (2)
CVE-2006-7210—doswindows
Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a
28RIESGO
abrir ↗
Referência✓ VexDay Proof
ThWboard 3.0b2.84-php5 - SQL Injection / Code Execution
CVE-2007-0340—webappsphp
SQL injection vulnerability in inc/header.inc.php in ThWboard 3.0b2.84-php5 and earlier allows remote attackers to execu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Apple Mac OSX 10.4.8 - SLP Daemon Service Registration Buffer Overflow (PoC)
CVE-2007-0355—dososx
Buffer overflow in the Apple Minimal SLP v2 Service Agent (slpd) in Mac OS X 10.4.11 and earlier, including 10.4.8, allo
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Uberghey 0.3.1 - 'FrontPage.php' Remote File Inclusion
CVE-2007-0359—webappsphp
PHP remote file inclusion vulnerability in frontpage.php in Uberghey CMS 0.3.1 allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Oreon 1.2.3 RC4 - '/lang/index.php' Remote File Inclusion
CVE-2007-0360—webappsphp
PHP remote file inclusion vulnerability in lang/index.php in Oreon 1.2.3 RC4 and earlier allows remote attackers to exec
23RIESGO
abrir ↗
Referência
CVE-2026-14236
CVE-2026-14236MEDIUM
Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect
33RIESGO
abrir ↗
Referência
CVE-2026-14203
CVE-2026-14203MEDIUM
Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title
33RIESGO
abrir ↗
Referência
CVE-2026-114577
CVE-2026-114577MEDIUM
oretnom23 php-travel-agency-system Insertion insert.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-114266
CVE-2026-114266MEDIUM
ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-114265
CVE-2026-114265MEDIUM
ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-90857
CVE-2026-90857MEDIUM
SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-90942
CVE-2026-90942CRITICAL
Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints
48RIESGO
abrir ↗
Referência
CVE-2026-82019
CVE-2026-82019LOW
TripleLift video-bundle.js DOM-based XSS via postMessage
28RIESGO
abrir ↗
Referência
CVE-2026-90713
CVE-2026-90713MEDIUM
vllm-project vLLM tiktoken vocab File mod.rs new denial of service
33RIESGO
abrir ↗
Referência
CVE-2026-90579
CVE-2026-90579MEDIUM
cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
33RIESGO
abrir ↗
Referência
CVE-2026-90577
CVE-2026-90577MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-90566
CVE-2026-90566MEDIUM
Rizwan17 inventory-management-system Registration register.php createUserAccount improper authorization
33RIESGO
abrir ↗
Referência
CVE-2026-90565
CVE-2026-90565MEDIUM
Rizwan17 inventory-management-system dashboard.php access control
33RIESGO
abrir ↗
Referência
CVE-2026-90525
CVE-2026-90525MEDIUM
itsourcecode Sales and Inventory System cust_pos_trans.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2022-44877
CVE-2022-44877CRITICALbajo ataque
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execut
100RIESGO
abrir ↗
Referência
CVE-2026-90522
CVE-2026-90522MEDIUM
jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery
33RIESGO
abrir ↗
Referência
CVE-2023-0904
CVE-2023-0904MEDIUM
SourceCodester Employee Task Management System task-details.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-76795
CVE-2026-76795MEDIUM
AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-76785
CVE-2026-76785MEDIUM
amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-18051
CVE-2026-18051CRITICAL
W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key
63RIESGO
abrir ↗
Referência
CVE-2026-14182
CVE-2026-14182CRITICAL
Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass
48RIESGO
abrir ↗
Referência
CVE-2026-18044
CVE-2026-18044LOW
Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch
28RIESGO
abrir ↗
← anteriorpágina 863 / 884siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.