Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.853exploits catalogados
39.383CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.447Exploit-DB 24.485GitHub PoC 16.269VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
5629 exploits
Referência✓ VexDay Proof
xGB 2.0 - 'xGB.php' Remote Security Bypass
xGB.php in xGB 2.0 does not require authentication for an admin edit action, which allows remote attackers to make unspe
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHPizabi 0.848b C1 HFP3 - Database Information Disclosure
The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings del
23RIESGO
abrir ↗Referência✓ VexDay Proof
DreamNews Manager - 'id' SQL Injection
SQL injection vulnerability in dreamnews-rss.php in DreamNews Manager allows remote attackers to execute arbitrary SQL c
23RIESGO
abrir ↗Referência✓ VexDay Proof
sma-db 0.3.12 - Remote File Inclusion / Cross-Site Scripting
PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗Referência✓ VexDay Proof
UltraISO 8.6.2.2011 - '.cue/'.bin' Local Buffer Overflow (PoC)
Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execute arbitrar
50RIESGO
abrir ↗Referência✓ VexDay Proof
NavBoard 2.6.0 - Remote Code Execution
Direct static code injection vulnerability in admin_config.php in NavBoard 2.6.0 allows remote attackers to inject arbit
23RIESGO
abrir ↗Referência✓ VexDay Proof
MFORUM 0.1a - Arbitrary Add Admin
Multiple SQL injection vulnerabilities in usercp.php in mForum 0.1a, when magic_quotes_gpc is disabled, allow remote att
23RIESGO
abrir ↗Referência✓ VexDay Proof
U&M Software Event Lister 1.0 - Authentication Bypass
U&M Software Event Lister (aka JustListIt) 1.0 does not require administrative authentication for all scripts in the adm
23RIESGO
abrir ↗Referência✓ VexDay Proof
zFeeder 1.6 - 'admin.php' Admin Bypass
zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php.
23RIESGO
abrir ↗Referência✓ VexDay Proof
phpBB Ajax Shoutbox 0.0.5 - Remote File Inclusion
PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows r
23RIESGO
abrir ↗Referência✓ VexDay Proof
MiniGal b13 - Remote Code Execution
The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a fil
23RIESGO
abrir ↗Referência✓ VexDay Proof
VWar 1.5.0 R15 - 'mvcw.php' Remote File Inclusion
PHP remote file inclusion vulnerability in convert/mvcw.php in Virtual War (VWar) 1.5.0 R15 and earlier allows remote at
23RIESGO
abrir ↗Referência✓ VexDay Proof
Fundanemt 2.2.0 - 'spellcheck.php' Remote Code Execution
core/spellcheck/spellcheck.php in Fundanemt before 2.2.0.1 allows remote attackers to execute arbitrary commands via she
23RIESGO
abrir ↗Referência✓ VexDay Proof
Ultimate PHP Board 2.2.1 - Privilege Escalation
Cross-site scripting (XSS) vulnerability in Ultimate PHP Board (UPB) 2.2.2, 2.2.1, and earlier 2.x versions allows remot
23RIESGO
abrir ↗Referência✓ VexDay Proof
Vistered Little 1.6a - 'skin' Remote File Disclosure
Directory traversal vulnerability in skins/common.css.php in Vistered Little 1.6a allows remote attackers to read arbitr
23RIESGO
abrir ↗Referência✓ VexDay Proof
Million Dollar Text Links 1.0 - Arbitrary Authentication Bypass
Million Dollar Text Links 1.0 does not properly restrict administrator access to admin.home.php, which allows remote att
23RIESGO
abrir ↗Referência✓ VexDay Proof
DesktopOnNet 3 Beta - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in DesktopOnNet 3 Beta allow remote attackers to execute arbitrary PH
23RIESGO
abrir ↗Referência✓ VexDay Proof
Avlc Forum - 'vlc_forum.php' SQL Injection
SQL injection vulnerability in vlc_forum.php in Avlc Forum as of 20080715 allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗Referência✓ VexDay Proof
Megacubo 5.0.7 - 'mega://' Remote 'eval()' Injection
Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the
23RIESGO
abrir ↗Referência✓ VexDay Proof
Claroline E-Learning 1.75 - 'ldap.inc.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP co
23RIESGO
abrir ↗Referência✓ VexDay Proof
OpenBASE 0.6a - 'root_prefix' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in OpenBASE Alpha 0.6 allow remote attackers to execute arbitrary PHP
23RIESGO
abrir ↗Referência✓ VexDay Proof
7Shop 1.1 - Arbitrary File Upload
Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to e
23RIESGO
abrir ↗Referência✓ VexDay Proof
ASP Portal - Multiple SQL Injections
Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1
23RIESGO
abrir ↗Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in Qsoft K-Rate Premium allow remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗Referência✓ VexDay Proof
32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a
23RIESGO
abrir ↗Referência✓ VexDay Proof
CMS Ortus 1.13 - SQL Injection
SQL injection vulnerability in engine/users/users_edit_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated
23RIESGO
abrir ↗Referência✓ VexDay Proof
3editor CMS 0.42 - 'index.php' Local File Inclusion
Directory traversal vulnerability in index.php in Matteo Lucarelli 3editor CMS 0.42 and earlier, when register_globals i
23RIESGO
abrir ↗Referência✓ VexDay Proof
F3Site 2.1 - Remote Code Execution
Unrestricted file upload vulnerability in F3Site 2.1 and earlier allows remote authenticated administrators to upload an
23RIESGO
abrir ↗Referência✓ VexDay Proof
Leap CMS 0.1.4 - 'searchterm' Blind SQL Injection
Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magic_quotes_gpc is disabled, allow remote at
23RIESGO
abrir ↗Referência✓ VexDay Proof
Vivvo CMS 3.4 - 'index.php' Blind SQL Injection
SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlie
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.