Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
79.107exploits catalogados
36.322CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8846Nuclei 4361Metasploit 3490✓ solo verificadosrecientespopularesriesgo
5629 exploits
Referência✓ VexDay Proof
Oxygen 2.0 - 'repquote' SQL Injection
SQL injection vulnerability in post.php in Oxygen (aka O2PHP Bulletin Board) 2.0 allows remote attackers to execute arbi
23RIESGO
abrir ↗Referência✓ VexDay Proof
Nitro Web Gallery 1.4.3 - 'section' SQL Injection
SQL injection vulnerability in albums.php in NiTrO Web Gallery 1.4.3 and earlier allows remote attackers to execute arbi
23RIESGO
abrir ↗Referência✓ VexDay Proof
CCleague Pro 1.0.1RC1 - 'cookie' Remote Code Execution
Directory traversal vulnerability in admin.php in CCleague Pro Sports CMS 1.0.1 RC1 allows remote attackers to read and
23RIESGO
abrir ↗Referência✓ VexDay Proof
SlimCMS 1.0.0 - 'redirect.php' Privilege Escalation
redirect.php in SlimCMS 1.0.0 does not require authentication, which allows remote attackers to create administrative us
23RIESGO
abrir ↗Referência✓ VexDay Proof
RPortal 1.1 - 'file_op' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in RPortal 1.1 and earlier allows remote attackers to execute arbit
23RIESGO
abrir ↗Referência✓ VexDay Proof
Socketwiz BookMarks 2.0 - 'root_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in smarty_config.php in Socketwiz Bookmarks 2.0 and earlier allows remote attack
23RIESGO
abrir ↗Referência✓ VexDay Proof
gCards 1.45 - Multiple Vulnerabilities
SQL injection vulnerability in loginfunction.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to
23RIESGO
abrir ↗Referência✓ VexDay Proof
NetProxy 4.03 - Web Filter Evasion / Bypass Logging
Grok Developments NetProxy 4.03 allows remote attackers to bypass URL filtering via a request that omits "http://" from
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHPEasyNews 1.13 RC2 - 'POST' SQL Injection
SQL injection vulnerability in newsarchive.php in PHPeasyblog (formerly phpeasynews) 1.13 RC2 and earlier allows remote
23RIESGO
abrir ↗Referência✓ VexDay Proof
APC ActionApps CMS 2.8.1 - Remote File Inclusion
PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a
28RIESGO
abrir ↗Referência✓ VexDay Proof
Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
RTE_popup_save_file.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload (1) .html and (2) .htm files v
23RIESGO
abrir ↗Referência✓ VexDay Proof
Noticeware Email Server 4.6.1.0 - Denial of Service
MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application cras
23RIESGO
abrir ↗Referência✓ VexDay Proof
Scientific Image DataBase 0.41 - Blind SQL Injection
SQL injection vulnerability in projects.php in Scientific Image DataBase 0.41 allows remote attackers to execute arbitra
23RIESGO
abrir ↗Referência✓ VexDay Proof
IGSuite 3.2.4 - Reverse Shell / Blind SQL Injection
SQL injection vulnerability in cgi-bin/igsuite in IGSuite 3.2.4 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗Referência✓ VexDay Proof
Online Grades 3.2.4 - Authentication Bypass
Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, whi
23RIESGO
abrir ↗Referência✓ VexDay Proof
DMXReady Registration Manager 1.1 - Database Disclosure
DMXReady Registration Manager 1.1 stores sensitive information under the web root with insufficient access control, whic
23RIESGO
abrir ↗Referência✓ VexDay Proof
Hot Open Tickets 11012004 - 'CLASS_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in admin/lib_action_step.php in Hot Open Tickets (HOT) 11012004_ver2f, when regi
23RIESGO
abrir ↗Referência✓ VexDay Proof
Azucar CMS 1.3 - '/admin/index_sitios.php' File Inclusion
PHP remote file inclusion vulnerability in admin/index_sitios.php in Azucar CMS 1.3 allows remote attackers to execute a
23RIESGO
abrir ↗Referência✓ VexDay Proof
FS4104-AW VDSL Device (Rooter) - GoAhead WebServer Disclosure
goform/QuickStart_c0 on the GoAhead Web Server on the FS4104-AW (aka rooter) VDSL device contains a password in the type
23RIESGO
abrir ↗Referência✓ VexDay Proof
Maxtrade AIO 1.3.23 - 'categori' SQL Injection
SQL injection vulnerability in the Trade module in Maxtrade AIO 1.3.23 allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗Referência✓ VexDay Proof
Easy Webstore 1.2 - SQL Injection
SQL injection vulnerability in index.php in Easy Webstore 1.2 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗Referência✓ VexDay Proof
preCMS 1 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in preCMS 1 allows remote attackers to execute arbitrary SQL commands via the i
23RIESGO
abrir ↗Referência✓ VexDay Proof
Drupal 4.7 - 'Attachment mod_mime' Remote Command Execution
Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple
28RIESGO
abrir ↗Referência✓ VexDay Proof
Easy Photo Gallery 2.1 - Arbitrary Add Admin / remove user
useradmin.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 does not require administrative authentication, which allow
23RIESGO
abrir ↗Referência✓ VexDay Proof
LoveCMS 1.6.2 Final - Arbitrary File Delete
Directory traversal vulnerability in system/admin/images.php in LoveCMS 1.6.2 Final allows remote attackers to delete ar
23RIESGO
abrir ↗Referência✓ VexDay Proof
fhttpd 0.4.2 - 'un64()' Remote Denial of Service
fhttpd 0.4.2 allows remote attackers to cause a denial of service (crash) via an Authorization HTTP header with an inval
23RIESGO
abrir ↗Referência✓ VexDay Proof
TemaTres 1.0.3 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote atta
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHP Webquest 2.6 - Get Database Credentials
PHP Webquest 2.6 allows remote attackers to retrieve database credentials via a direct request to admin/backup_phpwebque
23RIESGO
abrir ↗Referência✓ VexDay Proof
eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities
Multiple absolute path traversal vulnerabilities in eLineStudio Site Composer (ESC) 2.6 allow remote attackers to create
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHP Site Lock 2.0 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in Kalptaru Infotech PHP Site Lock 2.0 allows remote attackers to execute arbit
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.