Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.337exploits catalogados
39.873CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.822Exploit-DB 24.487GitHub PoC 17.115VulnCheck XDB 9874Nuclei 4511Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.822 exploits
Referência
CVE-2014-7186
CVE-2014-7186—
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial o
35RIESGO
abrir ↗
Referência✓ VexDay Proof
IndexScript 3.0 - 'parent_id' SQL Injection
CVE-2008-6179—webappsphp
SQL injection vulnerability in sug_cat.php in IndexScript 3.0 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2010-5300
CVE-2010-5300—
Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash
28RIESGO
abrir ↗
Referência
CVE-2013-3532
CVE-2013-3532—
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote
23RIESGO
abrir ↗
Referência
Centos WebPanel 7 - 'term' SQL Injection
CVE-2020-10230—webappslinux
CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/adm
28RIESGO
abrir ↗
Referência
CVE-2022-24715
CVE-2022-24715HIGH
Arbitrary code execution for authenticated users in Icinga Web 2
46RIESGO
abrir ↗
Referência✓ VexDay Proof
Adobe 8.1.4/9.1 - 'customDictionaryOpen()' Code Execution
CVE-2009-1493—remotelinux
The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and
28RIESGO
abrir ↗
Referência
CVE-2009-4680
CVE-2009-4680—
SQL injection vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência
CVE-2010-1306
CVE-2010-1306—
Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote at
43RIESGO
abrir ↗
Referência
CVE-2009-3663
CVE-2009-3663—
Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to
28RIESGO
abrir ↗
Referência
CVE-2013-3537
CVE-2013-3537—
Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2013-5220
CVE-2013-5220—
goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device
23RIESGO
abrir ↗
Referência✓ VexDay Proof
SourceForge 1.0.4 - 'database.php' Remote File Inclusion
CVE-2006-5562—webappsphp
PHP remote file inclusion vulnerability in include/database.php in SourceForge (aka alexandria) 1.0.4 allows remote atta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
BitchX 1.1 Final - MODE Remote Heap Overflow
CVE-2007-4584—remotelinux
Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC servers to execute arbitrary code via a long string in
28RIESGO
abrir ↗
Referência
CVE-2020-24223
CVE-2020-24223—
Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
43RIESGO
abrir ↗
Referência
CVE-2013-3893
CVE-2013-3893HIGHbajo ataque
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 throug
100RIESGO
abrir ↗
Referência
CVE-2026-15034
CVE-2026-15034MEDIUM
flask-dashboard Flask-MonitoringDashboard cross-site request forgery
33RIESGO
abrir ↗
Referência
CVE-2023-36812
CVE-2023-36812CRITICAL
Remote Code Execution in OpenTSDB
68RIESGO
abrir ↗
Referência
CVE-2013-3928
CVE-2013-3928—
Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote atta
50RIESGO
abrir ↗
Referência
CVE-2015-7246
CVE-2015-7246—
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root accou
28RIESGO
abrir ↗
Referência
CVE-2018-9958
CVE-2018-9958—
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1
50RIESGO
abrir ↗
Referência
CVE-2018-9958
CVE-2018-9958—
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1
50RIESGO
abrir ↗
Referência
CVE-2020-5377
CVE-2020-5377CRITICAL
Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities.
60RIESGO
abrir ↗
Referência
EasyNas 1.1.0 - OS Command Injection
CVE-2023-0830MEDIUMremotehardware
EasyNAS backup.pl system os command injection
38RIESGO
abrir ↗
Referência
CVE-2026-19857
CVE-2026-19857MEDIUM
Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token
33RIESGO
abrir ↗
Referência✓ VexDay Proof
ABC Advertise 1.0 - Admin Password Disclosure
CVE-2009-1550—webappsphp
Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2011-0917
CVE-2011-0917—
Buffer overflow in nLDAP.exe in IBM Lotus Domino allows remote attackers to execute arbitrary code via a long string in
28RIESGO
abrir ↗
Referência
CVE-2026-14797
CVE-2026-14797MEDIUM
CodeAstro Apartment Visitor Management System edit-apartment.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2014-4158
CVE-2014-4158—
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET req
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Mooseguy Blog System 1.0 - 'month' SQL Injection
CVE-2008-0424—webappsphp
SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
← anteriorpágina 98 / 861siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.