Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

76.107exploits catalogados
34.679CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.443Referência 21.692GitHub PoC 13.812VulnCheck XDB 8460Nuclei 4233Metasploit 3467✓ solo verificadosrecientespopularesriesgo
21.692 exploits
Referência
CVE-2012-6038
CVE-2012-6038—
admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directorie
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Poppawid 2.7 - 'form' Remote File Inclusion
CVE-2007-5221—webappsphp
PHP remote file inclusion vulnerability in mail/childwindow.inc.php in Poppawid 2.7 allows remote attackers to execute a
23RIESGO
abrir ↗
Referência
CVE-2010-1477
CVE-2010-1477—
SQL injection vulnerability in the SermonSpeaker (com_sermonspeaker) component before 3.2.1 for Joomla! allows remote at
23RIESGO
abrir ↗
Referência✓ VexDay Proof
RunCMS 1.6 - Multiple Vulnerabilities
CVE-2007-6546—webappsphp
RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a m
23RIESGO
abrir ↗
Referência✓ VexDay Proof
AlkalinePHP 0.77.35 - 'adduser.php' Arbitrary Add Admin
CVE-2008-2346—webappsphp
AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creat
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Tlnews 2.2 - Insecure Cookie Handling
CVE-2008-4752—webappsphp
TlNews 2.2 allows remote attackers to bypass authentication and gain administrative access by setting the tlNews_login c
23RIESGO
abrir ↗
Referência
CVE-2018-5978
CVE-2018-5978—
SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.
23RIESGO
abrir ↗
Referência
CVE-2018-6395
CVE-2018-6395—
SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.
23RIESGO
abrir ↗
Referência
CVE-2021-36520
CVE-2021-36520HIGH
A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI.
41RIESGO
abrir ↗
Referência✓ VexDay Proof
OPT Max 1.2.0 - 'CRM_inc' Remote File Inclusion
CVE-2006-4239—webappsphp
PHP remote file inclusion vulnerability in include/urights.php in Outreach Project Tool (OPT) Max 1.2.6 and earlier allo
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
CVE-2009-2159—webappsphp
backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote at
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpFullAnnu 5.1 - 'repmod' Remote File Inclusion
CVE-2006-4644—webappsphp
PHP remote file inclusion vulnerability in modules/home.module.php in phpFullAnnu 5.1 and earlier allows remote attacker
23RIESGO
abrir ↗
Referência
CVE-2010-1477
CVE-2010-1477—
SQL injection vulnerability in the SermonSpeaker (com_sermonspeaker) component before 3.2.1 for Joomla! allows remote at
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Star FTP Server 1.10 - 'RETR' Remote Denial of Service
CVE-2006-6643—doswindows
Fightersoft Multimedia Star FTP server 1.10 allows remote attackers to cause a denial of service (crash) via multiple RE
23RIESGO
abrir ↗
Referência
CVE-2018-8584
CVE-2018-8584—
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (A
23RIESGO
abrir ↗
Referência✓ VexDay Proof
photokron 1.7 - Remote Database Disclosure
CVE-2008-0297—webappsphp
PhotoKorn allows remote attackers to obtain database credentials via a direct request to update/update3.php, which inclu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
BolinOS 4.6.1 - Local File Inclusion / Cross-Site Scripting
CVE-2008-1557—webappsphp
BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/con
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Noticeware E-mail Server 5.1.2.2 - 'POP3' Denial of Service
CVE-2008-6185—doswindows
NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 reques
23RIESGO
abrir ↗
Referência
CVE-2014-9099
CVE-2014-9099—
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker
23RIESGO
abrir ↗
Referência
CVE-2017-14843
CVE-2017-14843—
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
23RIESGO
abrir ↗
Referência
CVE-2017-14842
CVE-2017-14842—
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
V-Webmail 1.6.4 - 'pear_dir' Remote File Inclusion
CVE-2006-2666—webappsphp
PHP remote file inclusion vulnerability in includes/mailaccess/pop3.php in V-Webmail 1.5 through 1.6.4 allows remote att
23RIESGO
abrir ↗
Referência✓ VexDay Proof
mrcgiguy the ticket system 2.0 PHP - Multiple Vulnerabilities
CVE-2009-2080—webappsphp
admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to (1) obta
23RIESGO
abrir ↗
Referência
CVE-2018-11715
CVE-2018-11715—
The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
DoceboLms 2.0.5 - 'help.php' Remote File Inclusion
CVE-2006-2668—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP co
23RIESGO
abrir ↗
Referência
CVE-2023-26692
CVE-2023-26692MEDIUM
ZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Manageme
33RIESGO
abrir ↗
Referência
CVE-2014-2088
CVE-2014-2088—
Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrar
23RIESGO
abrir ↗
Referência
CVE-2014-3991
CVE-2014-3991—
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary
23RIESGO
abrir ↗
Referência
CVE-2011-3645
CVE-2011-3645—
Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities
CVE-2008-2215—webappsphp
Multiple directory traversal vulnerabilities in Project-Based Calendaring System (PBCS) 0.7.1-1 allow remote attackers t
23RIESGO
abrir ↗
← anteriorpágina 292 / 724siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.