Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
85.337exploits catalogados
39.873CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.822Exploit-DB 24.487GitHub PoC 17.115VulnCheck XDB 9874Nuclei 4511Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.822 exploits
Referência
CVE-2016-20016
MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /
85RIESGO
abrir ↗Referência
CVE-2026-14214
Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
28RIESGO
abrir ↗Referência
CVE-2013-5019
Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resour
50RIESGO
abrir ↗Referência
CVE-2013-7091
Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zim
60RIESGO
abrir ↗Referência
CVE-2019-1003001
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
60RIESGO
abrir ↗Referência
CVE-2026-108807
krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injection
33RIESGO
abrir ↗Referência✓ VexDay Proof
DeluxeBB 1.2 - Blind SQL Injection
SQL injection vulnerability in pm.php in DeluxeBB 1.2 and earlier, when magic_quotes_gpc is disabled, allows remote atta
23RIESGO
abrir ↗Referência
CVE-2009-3189
Cross-site scripting (XSS) vulnerability in search.php in DigiOz Guestbook 1.7.2 allows remote attackers to inject arbit
23RIESGO
abrir ↗Referência
CVE-2009-3190
Multiple SQL injection vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗Referência
CVE-2012-1008
OfficeSIP Server 3.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted To header in a SI
28RIESGO
abrir ↗Referência✓ VexDay Proof
LoveCMS 1.6.2 Final (Simple Forum 3.1d) - Change Admin Password
The Simple Forum 3.1d module for LoveCMS 1.6.2 Final does not properly restrict access to administrator functions, which
23RIESGO
abrir ↗Referência✓ VexDay Proof
Mambo Component com_lurm_constructor 0.6b - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.lurm_constructor.php in the Lurm Constructor component (com_lurm_constr
23RIESGO
abrir ↗Referência✓ VexDay Proof
Invision Gallery 2.0.7 - 'readfile()' / SQL Injection
Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a .. (do
28RIESGO
abrir ↗Referência
CVE-2013-0090
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary co
53RIESGO
abrir ↗Referência
CVE-2015-2843
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute
50RIESGO
abrir ↗Referência
CVE-2018-7658
NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service
35RIESGO
abrir ↗Referência
CVE-2018-8474
A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messa
35RIESGO
abrir ↗Referência✓ VexDay Proof
Sepcity Shopping Mall - SQL Injection
SQL injection vulnerability in shpdetails.asp in SepCity Shopping Mall allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗Referência
CVE-2009-3205
SQL injection vulnerability in main.php in CBAuthority allows remote attackers to execute arbitrary SQL commands via the
23RIESGO
abrir ↗Referência
IOTransfer V4 - Unquoted Service Path
IOBit IOTransfer V4 is vulnerable to Unquoted Service Path.
41RIESGO
abrir ↗Referência
CVE-2019-16893
The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the
35RIESGO
abrir ↗Referência
CVE-2019-10945
An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder param
35RIESGO
abrir ↗Referência
CVE-2019-10945
An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder param
35RIESGO
abrir ↗Referência✓ VexDay Proof
Joomla! Component Kbase 1.0 - SQL Injection
SQL injection vulnerability in the KBase (com_kbase) 1.2 component for Joomla! allows remote attackers to execute arbitr
23RIESGO
abrir ↗Referência
CVE-2022-47878
Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authentica
60RIESGO
abrir ↗Referência✓ VexDay Proof
vidshare pro - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.php in VidSharePro allows remote attackers to inject arbitrary web sc
23RIESGO
abrir ↗Referência
CVE-2009-3223
SQL injection vulnerability in ppc-add-keywords.php in Inout Adserver allows remote authenticated users to execute arbit
23RIESGO
abrir ↗Referência✓ VexDay Proof
Claroline 1.8.0 rc1 - 'import.lib.php' Remote File Inclusion
PHP remote file inclusion vulnerability in claroline/inc/lib/import.lib.php in Claroline 1.8.0 and earlier allows remote
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.