Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.853exploits catalogados
39.383CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
5629 exploits
Referência✓ VexDay Proof
GeekLog 2.x - 'ImageImageMagick.php' Remote File Inclusion
PHP remote file inclusion vulnerability in ImageImageMagick.php in Geeklog 2.x allows remote attackers to execute arbitr
35RIESGO
abrir ↗Referência✓ VexDay Proof
Micro CMS 0.3.5 - Remote Add/Delete/Password Change
microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an
23RIESGO
abrir ↗Referência✓ VexDay Proof
Ol BookMarks Manager 0.7.4 - 'root' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in ol'bookmarks 0.7.4 allow remote attackers to execute arbitrary PHP
28RIESGO
abrir ↗Referência✓ VexDay Proof
HIOX Banner Rotator 1.3 - 'hm' Remote File Inclusion
PHP remote file inclusion vulnerability in hioxBannerRotate.php in HIOX Banner Rotator (HBR) 1.3, when register_globals
23RIESGO
abrir ↗Referência✓ VexDay Proof
minimal ablog 0.4 - SQL Injection / Arbitrary File Upload / Authentication Bypass
Unrestricted file upload vulnerability in admin/uploader.php in Minimal ABlog 0.4 allows remote attackers to execute arb
23RIESGO
abrir ↗Referência✓ VexDay Proof
4Images 1.7.7 - Filter Bypass HTML Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitr
23RIESGO
abrir ↗Referência✓ VexDay Proof
TOWeLS 0.1 - 'scripture.php' Remote File Inclusion
PHP remote file inclusion vulnerability in src/scripture.php in The Online Web Library Site (TOWels) 0.1 allows remote a
28RIESGO
abrir ↗Referência✓ VexDay Proof
CcMail 1.0.1 - Insecure Cookie Handling
Cicoandcico CcMail 1.0.1 and earlier does not verify that the this_cookie cookie corresponds to an authenticated session
23RIESGO
abrir ↗Referência✓ VexDay Proof
Download Accelerator Plus DAP 8.x - '.m3u' File Buffer Overflow
Stack-based buffer overflow in DAP.exe in Download Accelerator Plus (DAP) 7.0.1.3, 8.6.6.3, and other 8.x versions allow
23RIESGO
abrir ↗Referência✓ VexDay Proof
CCLeague Pro 1.2 - Insecure Cookie Authentication
admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin
23RIESGO
abrir ↗Referência✓ VexDay Proof
XOOPS Module Uploader 1.1 - 'Filename' File Disclosure
Directory traversal vulnerability in Uploader module 1.1 for XOOPS allows remote attackers to read arbitrary files via a
23RIESGO
abrir ↗Referência✓ VexDay Proof
xNews 1.3 - 'xNews.php' SQL Injection
SQL injection vulnerability in xNews.php in xNews 1.3 allows remote attackers to execute arbitrary SQL commands via the
23RIESGO
abrir ↗Referência✓ VexDay Proof
Pinnacle Studio 12 - '.hfz' Directory Traversal
InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote
23RIESGO
abrir ↗Referência✓ VexDay Proof
X-ice News System 1.0 - 'devami.asp?id' SQL Injection
SQL injection vulnerability in devami.asp in X-Ice News System 1.0 allows remote attackers to execute arbitrary SQL comm
23RIESGO
abrir ↗Referência✓ VexDay Proof
XOOPS Module Friendfinder 3.3 - 'view.php?id' SQL Injection
SQL injection vulnerability in view.php in the Friendfinder 3.3 and earlier module for Xoops allows remote attackers to
23RIESGO
abrir ↗Referência✓ VexDay Proof
BBPortalS 2.0 - Blind SQL Injection
SQL injection vulnerability in tnews.php in BBsProcesS BBPortalS 1.5.10 through 2.0 allows remote attackers to execute a
23RIESGO
abrir ↗Referência✓ VexDay Proof
ImperialBB 2.3.5 - Arbitrary File Upload
Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and e
23RIESGO
abrir ↗Referência✓ VexDay Proof
pPIM 1.0 - Arbitrary File Delete / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in events.php in Phlatline's Personal Information Manager (pPIM) 1.0 allows rem
23RIESGO
abrir ↗Referência✓ VexDay Proof
Skype Extension for Firefox Beta 2.2.0.95 - Clipboard Writing
The skype_tool.copy_num method in the Skype extension BETA 2.2.0.95 for Firefox allows remote attackers to write arbitra
23RIESGO
abrir ↗Referência✓ VexDay Proof
sma-db 0.3.12 - Remote File Inclusion / Cross-Site Scripting
PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗Referência✓ VexDay Proof
UltraISO 8.6.2.2011 - '.cue/'.bin' Local Buffer Overflow (PoC)
Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execute arbitrar
50RIESGO
abrir ↗Referência✓ VexDay Proof
NavBoard 2.6.0 - Remote Code Execution
Direct static code injection vulnerability in admin_config.php in NavBoard 2.6.0 allows remote attackers to inject arbit
23RIESGO
abrir ↗Referência✓ VexDay Proof
MFORUM 0.1a - Arbitrary Add Admin
Multiple SQL injection vulnerabilities in usercp.php in mForum 0.1a, when magic_quotes_gpc is disabled, allow remote att
23RIESGO
abrir ↗Referência✓ VexDay Proof
MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting
Sam Crew MyBlog stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain se
23RIESGO
abrir ↗Referência✓ VexDay Proof
TurnkeyForms Entertainment Portal 2.0 - Insecure Cookie Handling
TurnkeyForms Entertainment Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by
23RIESGO
abrir ↗Referência✓ VexDay Proof
Scribe 0.2 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in Scribe 0.2 allows remote attackers to read arbitrary local files via a
23RIESGO
abrir ↗Referência✓ VexDay Proof
Bitweaver 2.6 - 'saveFeed()' Remote Code Execution
Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 an
23RIESGO
abrir ↗Referência✓ VexDay Proof
Alstrasoft AskMe Pro 2.1 - Multiple SQL Injections
AlstraSoft AskMe Pro 2.1 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent a
23RIESGO
abrir ↗Referência✓ VexDay Proof
AyeView 2.20 - '.GIF' Image Local Crash
AyeView 2.20 allows user-assisted attackers to cause a denial of service (application crash) via a GIF file with a malfo
23RIESGO
abrir ↗Referência✓ VexDay Proof
Online Grades & Attendance 3.2.6 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when r
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.