Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.058exploits catalogados
35.300CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.451Referência 22.175GitHub PoC 14.096VulnCheck XDB 8607Nuclei 4255Metasploit 3474✓ solo verificadosrecientespopularesriesgo
22.175 exploits
Referência
CVE-2017-9413
CVE-2017-9413—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attacke
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Blog:CMS 4.2.1b - SQL Injection / Cross-Site Scripting
CVE-2008-0359—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1b allow remote attackers to inject arbitrary web sc
23RIESGO
abrir ↗
Referência✓ VexDay Proof
E-Store Kit-1 < 2 PayPal Edition - 'pid' SQL Injection
CVE-2008-3594—webappsphp
SQL injection vulnerability in viewdetails.php in MagicScripts E-Store Kit-1, E-Store Kit-2, E-Store Kit-1 Pro PayPal Ed
23RIESGO
abrir ↗
Referência✓ VexDay Proof
OpenImpro 1.1 - 'image.php' SQL Injection
CVE-2008-3599—webappsphp
SQL injection vulnerability in image.php in OpenImpro 1.1 allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Quicksilver Forums 1.4.1 - SQL Injection
CVE-2008-3601—webappsphp
SQL injection vulnerability in index.php in Quicksilver Forums 1.4.1 allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TekBase All-in-One 3.1 - Multiple SQL Injections
CVE-2009-2120—webappsphp
Multiple SQL injection vulnerabilities in TekBase All-in-One 3.1 allow remote authenticated users to execute arbitrary S
23RIESGO
abrir ↗
Referência
CVE-2026-5776
CVE-2026-5776MEDIUM
Email Encoder < 2.4.7 - Unauthenticated Stored XSS
33RIESGO
abrir ↗
Referência
CVE-2009-4888
CVE-2009-4888—
Cross-site scripting (XSS) vulnerability in poster.php in PHortail 1.2.1 allows remote attackers to inject arbitrary web
23RIESGO
abrir ↗
Referência
CVE-2017-8839
CVE-2017-8839—
XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_38
23RIESGO
abrir ↗
Referência
CVE-2009-3803
CVE-2009-3803—
Multiple cross-site scripting (XSS) vulnerabilities in Amiro.CMS 5.4.0.0 and earlier allow remote attackers to inject ar
23RIESGO
abrir ↗
Referência
CVE-2007-0132
CVE-2007-0132—
SQL injection vulnerability in compare_product.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2007-3889
CVE-2007-3889—
Multiple SQL injection vulnerabilities in Insanely Simple Blog 0.5 and earlier allow remote attackers to execute arbitra
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ig shop 1.0 - Code Execution / SQL Injection
CVE-2007-0132—webappsphp
SQL injection vulnerability in compare_product.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2008-3752
CVE-2008-3752—
SQL injection vulnerability in tr.php in YourFreeWorld Ad-Exchange Script allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência
CVE-2008-3754
CVE-2008-3754—
SQL injection vulnerability in trl.php in YourFreeWorld Stylish Text Ads Script allows remote attackers to execute arbit
23RIESGO
abrir ↗
Referência
CVE-2010-4893
CVE-2010-4893—
Cross-site scripting (XSS) vulnerability in foodvendors.php in FestOS 2.3b allows remote attackers to inject arbitrary w
23RIESGO
abrir ↗
Referência
CVE-2016-8805
CVE-2016-8805—
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3
23RIESGO
abrir ↗
Referência
CVE-2026-41949
CVE-2026-41949HIGH
Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
41RIESGO
abrir ↗
Referência
CVE-2016-7390
CVE-2016-7390—
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3
23RIESGO
abrir ↗
Referência
CVE-2023-4117
CVE-2023-4117MEDIUM
PHP Jabbers Rental Property Booking index.php cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-41948
CVE-2026-41948CRITICAL
Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
48RIESGO
abrir ↗
Referência✓ VexDay Proof
Quick Poll Script - 'id' SQL Injection
CVE-2008-3765—webappsphp
SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands v
23RIESGO
abrir ↗
Referência
CVE-2015-2198
CVE-2015-2198—
Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to i
23RIESGO
abrir ↗
Referência✓ VexDay Proof
cPanel WebHost Manager (WHM) - '/webmail/x3/mail/clientconf.html?acct' Cross-Site Scripting
CVE-2012-6448—webappsphp
Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web scrip
23RIESGO
abrir ↗
Referência✓ VexDay Proof
ModernBill 4.4.x - Cross-Site Scripting / Remote File Inclusion
CVE-2008-5059—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in ModernBill 4.4 and earlier allows remote attackers to inject ar
23RIESGO
abrir ↗
Referência
CVE-2009-20009
CVE-2009-20009CRITICAL
Belkin Bulldog Plus Web Service Buffer Overflow
63RIESGO
abrir ↗
Referência
CVE-2009-20009
CVE-2009-20009CRITICAL
Belkin Bulldog Plus Web Service Buffer Overflow
63RIESGO
abrir ↗
Referência
CVE-2025-34055
CVE-2025-34055CRITICAL
AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution
48RIESGO
abrir ↗
Referência
CVE-2016-7084
CVE-2016-7084—
tpview.dll in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, whe
23RIESGO
abrir ↗
Referência
CVE-2022-40684
CVE-2022-40684CRITICALbajo ataqueransomware
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RIESGO
abrir ↗
← anteriorpágina 403 / 740siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.