Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
85.337exploits catalogados
39.873CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.822Exploit-DB 24.487GitHub PoC 17.115VulnCheck XDB 9874Nuclei 4511Metasploit 3528✓ solo verificadosrecientespopularesriesgo
25.822 exploits
Referência✓ VexDay Proof
p4CMS 1.05 - 'abs_pfad' Remote File Inclusion
PHP remote file inclusion vulnerability in abf_js.php in p4CMS 1.05 allows remote attackers to execute arbitrary PHP cod
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHPht Topsites - 'common.php' Remote File Inclusion
PHP remote file inclusion vulnerability in common.php in Hinton Design phpht Topsites allows remote attackers to execute
23RIESGO
abrir ↗Referência
CVE-2013-5065
NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges
98RIESGO
abrir ↗Referência
CVE-2015-6168
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
35RIESGO
abrir ↗Referência
CVE-2016-0971
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS
35RIESGO
abrir ↗Referência
CVE-2017-11282
Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation co
35RIESGO
abrir ↗Referência
CVE-2019-10266
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL
28RIESGO
abrir ↗Referência
CVE-2021-37975
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corrup
83RIESGO
abrir ↗Referência✓ VexDay Proof
MiniPort@l 0.1.5 Beta - 'skiny' Remote File Inclusion
PHP remote file inclusion vulnerability in menu.php in MiniPort@l 2.0 and earlier allows remote attackers to execute arb
23RIESGO
abrir ↗Referência
CVE-2026-108625
JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint
33RIESGO
abrir ↗Referência✓ VexDay Proof
SFS EZ Webstore - 'where' SQL Injection
SQL injection vulnerability in SearchResults.php in Scripts For Sites (SFS) EZ e-store allows remote attackers to execut
23RIESGO
abrir ↗Referência✓ VexDay Proof
phpBugTracker 1.0.3 - Authentication Bypass
SQL injection vulnerability in index.php in phpBugTracker 1.0.3 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗Referência
CVE-2010-2103
Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Ap
35RIESGO
abrir ↗Referência
CVE-2012-1297
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier
23RIESGO
abrir ↗Referência
CVE-2012-1417
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow
23RIESGO
abrir ↗Referência
CVE-2015-2177
Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via craf
53RIESGO
abrir ↗Referência
CVE-2016-9150
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
35RIESGO
abrir ↗Referência
CVE-2019-9880
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible,
50RIESGO
abrir ↗Referência
CVE-2016-2233
Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC serve
35RIESGO
abrir ↗Referência✓ VexDay Proof
SFS EZ BIZ PRO - SQL Injection
SQL injection vulnerability in track.php in Scripts For Sites (SFS) EZ BIZ PRO allows remote attackers to execute arbitr
23RIESGO
abrir ↗Referência
CVE-2020-8656
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthe
60RIESGO
abrir ↗Referência
CVE-2022-27226
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in
35RIESGO
abrir ↗Referência✓ VexDay Proof
unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities
SQL injection vulnerability in the UnbDbEncode function in unb_lib/database.lib.php in Unclassified NewsBoard (UNB) 1.6.
23RIESGO
abrir ↗Referência
CVE-2016-2233
Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC serve
35RIESGO
abrir ↗Referência✓ VexDay Proof
WebCalendar 1.2.4 - Remote Code Execution
install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user
60RIESGO
abrir ↗Referência
CVE-2019-12828
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and orig
28RIESGO
abrir ↗Referência
CVE-2026-105097
Omega Solution CoinEx Crypto Customer Information API customer-currency authorization
33RIESGO
abrir ↗Referência✓ VexDay Proof
Galatolo Web Manager 1.3a - Cross-Site Scripting / SQL Injection
SQL injection vulnerability in plugins/users/index.php in Galatolo WebManager 1.3a and earlier allows remote attackers t
23RIESGO
abrir ↗Referência
CVE-2018-8898
A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B0
28RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.