Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

76.107exploits catalogados
34.679CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.443Referência 21.692GitHub PoC 13.812VulnCheck XDB 8460Nuclei 4233Metasploit 3467✓ solo verificadosrecientespopularesriesgo
21.692 exploits
Referência
CVE-2010-1226
CVE-2010-1226—
The HTTP client functionality in Apple iPhone OS 3.1 on the iPhone 2G and 3.1.3 on the iPhone 3GS allows remote attacker
23RIESGO
abrir ↗
Referência
CVE-2010-2129
CVE-2010-2129—
Directory traversal vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.1 and 1.0.3 for
23RIESGO
abrir ↗
Referência
CVE-2010-2129
CVE-2010-2129—
Directory traversal vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.1 and 1.0.3 for
23RIESGO
abrir ↗
Referência
CVE-2018-9163
CVE-2018-9163—
A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) all
23RIESGO
abrir ↗
Referência
CVE-2023-1020
CVE-2023-1020CRITICAL
Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi
63RIESGO
abrir ↗
Referência
CVE-2012-3809
CVE-2012-3809—
Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.
23RIESGO
abrir ↗
Referência
CVE-2014-2044
CVE-2014-2044—
Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote aut
28RIESGO
abrir ↗
Referência
CVE-2014-2044
CVE-2014-2044—
Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote aut
28RIESGO
abrir ↗
Referência
CVE-2012-3808
CVE-2012-3808—
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
NUNE News Script 2.0pre2 - Multiple Remote File Inclusions
CVE-2007-0143—webappsphp
Multiple PHP remote file inclusion vulnerabilities in NUNE News Script 2.0pre2 allow remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência✓ VexDay Proof
eFiction 3.1.1 - 'path_to_smf' Remote File Inclusion
CVE-2007-1118—webappsphp
Multiple PHP remote file inclusion vulnerabilities in eFiction 3.1.1 and earlier allow remote attackers to execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Yappa-ng 2.3.3-beta0 - 'album' Local File Inclusion
CVE-2008-4626—webappsphp
Directory traversal vulnerability in index.php in Fritz Berger yet another php photo album - next generation (yappa-ng)
23RIESGO
abrir ↗
Referência✓ VexDay Proof
minb 0.1.0 - Remote Code Execution
CVE-2008-7005—webappsphp
include/modules/top/1-random_quote.php in Minb Is Not a Blog (minb) 0.1.0 allows remote attackers to execute arbitrary P
23RIESGO
abrir ↗
Referência
CVE-2026-9271
CVE-2026-9271MEDIUM
KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS
33RIESGO
abrir ↗
Referência
CVE-2023-54335
CVE-2023-54335CRITICAL
eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)
48RIESGO
abrir ↗
Referência
CVE-2021-28242
CVE-2021-28242—
SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive dat
23RIESGO
abrir ↗
Referência
CVE-2017-0300
CVE-2017-0300—
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RIESGO
abrir ↗
Referência
CVE-2019-13623
CVE-2019-13623—
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive)
23RIESGO
abrir ↗
Referência
CVE-2013-4868
CVE-2013-4868—
Karotz API 12.07.19.00: Session Token Information Disclosure
23RIESGO
abrir ↗
Referência
CVE-2018-10188
CVE-2018-10188—
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_ope
23RIESGO
abrir ↗
Referência
CVE-2017-0100
CVE-2017-0100—
A DCOM object in Helppane.exe in Microsoft Windows 7 SP1; Windows Server 2008 R2; Windows 8.1; Windows Server 2012 Gold
23RIESGO
abrir ↗
Referência
CVE-2022-4117
CVE-2022-4117CRITICAL
IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLi
63RIESGO
abrir ↗
Referência
CVE-2017-4916
CVE-2017-4916—
VMware Workstation Pro/Player contains a NULL pointer dereference vulnerability that exists in the vstor2 driver. Succes
23RIESGO
abrir ↗
Referência
CVE-2014-9261
CVE-2014-9261—
The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which
23RIESGO
abrir ↗
Referência
CVE-2014-9261
CVE-2014-9261—
The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which
23RIESGO
abrir ↗
Referência
CVE-2010-3155
CVE-2010-3155—
Untrusted search path vulnerability in Adobe ExtendScript Toolkit (ESTK) CS5 3.5.0.52 allows local users, and possibly r
28RIESGO
abrir ↗
Referência
CVE-2017-15014
CVE-2017-15014—
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design ga
23RIESGO
abrir ↗
Referência
CVE-2022-37255
CVE-2022-37255HIGH
TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL07552646
41RIESGO
abrir ↗
Referência✓ VexDay Proof
ICQ 6.5 - URL Search Hook (Windows Explorer) Remote Buffer Overflow (PoC)
CVE-2009-1915—doswindows
Stack-based buffer overflow in the URL Search Hook (ICQToolBar.dll) in ICQ 6.5 allows remote attackers to cause a denial
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WEBO (Web ORGanizer) 1.0 - 'baseDir' Remote File Inclusion
CVE-2007-1391—webappsphp
PHP remote file inclusion vulnerability in modules/abook/foldertree.php in Leo West WEBO (aka weborganizer) 1.0 allows r
23RIESGO
abrir ↗
← anteriorpágina 287 / 724siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.