Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
79.305exploits catalogados
36.465CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.466Referência 23.051GitHub PoC 15.051VulnCheck XDB 8883Nuclei 4361Metasploit 3493✓ solo verificadosrecientespopularesriesgo
5629 exploits
Referência✓ VexDay Proof
All Club CMS 0.0.2 - Remote Database Configuration Retrieve
All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information under the web root with insufficient access control,
23RIESGO
abrir ↗Referência✓ VexDay Proof
TinyWebGallery 1.7.6 - Local File Inclusion / Remote Code Execution
Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as
23RIESGO
abrir ↗Referência✓ VexDay Proof
ASP.NET w3wp - COM Components Remote Crash
Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM com
35RIESGO
abrir ↗Referência✓ VexDay Proof
Enthrallweb eClassifieds 1.0 - Remote User Pass Change
myprofile.asp in Enthrallweb eClassifieds does not properly validate the MM_recordId parameter during profile updates, w
23RIESGO
abrir ↗Referência✓ VexDay Proof
BigACE 2.4 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in BigACE 2.4, when register_globals is enabled, allow remote attacke
23RIESGO
abrir ↗Referência✓ VexDay Proof
Tuned Studios Templates - Local File Inclusion
Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange C
23RIESGO
abrir ↗Referência✓ VexDay Proof
Family Connections CMS 1.4 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated user
23RIESGO
abrir ↗Referência✓ VexDay Proof
Mini Blog 1.0.1 - 'index.php' Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in index.php in Mini Blog 1.0.1 allow remote attackers to include and execu
23RIESGO
abrir ↗Referência✓ VexDay Proof
AJ Auction - Authentication Bypass
AJ Square AJ Auction Pro Platinum Skin #1 sends a redirect but does not exit when it is called directly, which allows re
23RIESGO
abrir ↗Referência✓ VexDay Proof
iScripts Socialware - 'id' SQL Injection
iScripts SocialWare stores passwords in cleartext in a database, which allows context-dependent attackers to obtain sens
23RIESGO
abrir ↗Referência✓ VexDay Proof
IndexScript 2.8 - 'cat_id' SQL Injection
SQL injection vulnerability in show_cat.php in IndexScript 2.8 and earlier allows remote attackers to execute arbitrary
23RIESGO
abrir ↗Referência✓ VexDay Proof
BtiTracker 1.4.7 / xbtit 2.0.542 - SQL Injection
SQL injection vulnerability in scrape.php in BtiTracker 1.4.7 and earlier and xBtiTracker 2.0.542 and earlier allows rem
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHPMyCart 1.3 - 'cat' SQL Injection
SQL injection vulnerability in shop.php in Conkurent PHPMyCart allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗Referência✓ VexDay Proof
phpBookingCalendar 1.0c - 'details_view.php' SQL Injection
SQL injection vulnerability in details_view.php in PHP Booking Calendar 1.0c and earlier allows remote attackers to exec
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHP Coupon Script 3.0 - 'bus' SQL Injection
SQL injection vulnerability in index.php in PHP Coupon Script 3.0 allows remote attackers to execute arbitrary SQL comma
23RIESGO
abrir ↗Referência✓ VexDay Proof
Micro CMS 0.3.5 - Remote Add/Delete/Password Change
microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an
23RIESGO
abrir ↗Referência✓ VexDay Proof
xml2owl 0.1.1 - 'showcode.php' Remote Command Execution
showCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path
23RIESGO
abrir ↗Referência✓ VexDay Proof
microssys CMS 1.5 - Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_glob
23RIESGO
abrir ↗Referência✓ VexDay Proof
deeemm CMS (dmcms) 0.7.4 - Multiple Vulnerabilities
PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to exec
23RIESGO
abrir ↗Referência✓ VexDay Proof
wotw 5.0 - Local/Remote File Inclusion
PHP remote file inclusion vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote att
23RIESGO
abrir ↗Referência✓ VexDay Proof
GRBoard 1.8 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when register_globals is enabled and magic_quotes_gpc
23RIESGO
abrir ↗Referência✓ VexDay Proof
acute control panel 1.0.0 - SQL Injection / Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitr
23RIESGO
abrir ↗Referência✓ VexDay Proof
PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload
PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpi
23RIESGO
abrir ↗Referência✓ VexDay Proof
vhostadmin 0.1 - 'MODULES_DIR' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/mail/main.php in Inter7 vHostAdmin 1.0 allows remote attackers to exe
23RIESGO
abrir ↗Referência✓ VexDay Proof
jGallery 1.3 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in jGallery 1.3 allows remote attackers to execute arbitrary PHP co
23RIESGO
abrir ↗Referência✓ VexDay Proof
Zomplog 3.8.2 - 'newuser.php' Arbitrary Add Admin
Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direc
23RIESGO
abrir ↗Referência✓ VexDay Proof
Squirrelcart 1.x - 'cart.php' Remote File Inclusion
PHP remote file inclusion vulnerability in popup_window.php in Squirrelcart 1.x.x and earlier allows remote attackers to
23RIESGO
abrir ↗Referência✓ VexDay Proof
PacPoll 4.0 - Database Disclosure
PacPoll 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attack
23RIESGO
abrir ↗Referência✓ VexDay Proof
webid 0.5.4 - Multiple Vulnerabilities
WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allow
23RIESGO
abrir ↗Referência✓ VexDay Proof
PHP Photo Gallery 1.0 - 'photo_id' SQL Injection
Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 stores passwords in cleartext in a MySQL database, which a
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.