Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.302exploits catalogados
35.469CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.451Referência 22.301GitHub PoC 14.141VulnCheck XDB 8646Nuclei 4289Metasploit 3474✓ solo verificadosrecientespopularesriesgo
22.301 exploits
Referência
CVE-2026-9485
CVE-2026-9485MEDIUM
SourceCodester Student Grades Management System students.php cross site scripting
33RIESGO
abrir ↗
Referência✓ VexDay Proof
OWL Intranet Engine 0.82 - 'xrms_file_root' Code Execution
CVE-2006-1149—webappsphp
PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled
23RIESGO
abrir ↗
Referência
CVE-2011-4572
CVE-2011-4572—
Cross-site scripting (XSS) vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82, 1.4.1, and probably
23RIESGO
abrir ↗
Referência
CVE-2014-8954
CVE-2014-8954—
Multiple cross-site scripting (XSS) vulnerabilities in phpSound 1.0.5 allow remote attackers to inject arbitrary web scr
23RIESGO
abrir ↗
Referência
CVE-2014-8954
CVE-2014-8954—
Multiple cross-site scripting (XSS) vulnerabilities in phpSound 1.0.5 allow remote attackers to inject arbitrary web scr
23RIESGO
abrir ↗
Referência
CVE-2014-8997
CVE-2014-8997—
Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 al
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Ultrastats 0.2.144/0.3.11 - 'serverid' SQL Injection
CVE-2008-6260—webappsphp
SQL injection vulnerability in index.php in Ultrastats 0.2.144 and 0.3.11 allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Apoll 0.7b - Authentication Bypass
CVE-2008-6270—webappsphp
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
E-topbiz ADManager 4 - 'group' Blind SQL Injection
CVE-2008-6261—webappsphp
SQL injection vulnerability in view.php in E-topbiz AdManager 4 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2026-9552
CVE-2026-9552MEDIUM
Das Parking Management System 停车场管理系统 Search API Endpoint sql injection
33RIESGO
abrir ↗
Referência
CVE-2019-8926
CVE-2019-8926—
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zon
23RIESGO
abrir ↗
Referência
CVE-2026-9551
CVE-2026-9551MEDIUM
Das Parking Management System 停车场管理系统 API Endpoint ExportParkingRecords xp_cmdshell sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-9550
CVE-2026-9550MEDIUM
Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform upfile path traversal
33RIESGO
abrir ↗
Referência
CVE-2026-9519
CVE-2026-9519MEDIUM
stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2019-8928
CVE-2019-8928—
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userMan
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Cyberfolio 7.12.2 - 'theme' Local File Inclusion
CVE-2008-6265—webappsphp
Directory traversal vulnerability in portfolio/css.php in Cyberfolio 7.12.2 and earlier allows remote attackers to inclu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Apoll 0.7b - Authentication Bypass
CVE-2008-6272—webappsphp
SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Family Project 2.x - Authentication Bypass
CVE-2008-6274—webappsphp
Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Bluo CMS 1.2 - Blind SQL Injection
CVE-2008-6281—webappsphp
SQL injection vulnerability in index.php in Bluo CMS 1.2 allows remote attackers to execute arbitrary SQL commands via t
23RIESGO
abrir ↗
Referência✓ VexDay Proof
z1exchange 1.0 - 'site' SQL Injection
CVE-2008-6284—webappsphp
SQL injection vulnerability in edit.php in Z1Exchange 1.0 allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência
CVE-2026-8212
CVE-2026-8212MEDIUM
OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-8211
CVE-2026-8211MEDIUM
codelibs Fess JSP File AdminDesignAction.java update code injection
33RIESGO
abrir ↗
Referência
CVE-2026-16205
CVE-2026-16205MEDIUM
Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2014-8998
CVE-2014-8998—
lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a c
50RIESGO
abrir ↗
Referência
CVE-2014-8998
CVE-2014-8998—
lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a c
50RIESGO
abrir ↗
Referência
CVE-2014-9004
CVE-2014-9004—
Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web sc
23RIESGO
abrir ↗
Referência
CVE-2014-9014
CVE-2014-9014—
Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin b
28RIESGO
abrir ↗
Referência
CVE-2026-9515
CVE-2026-9515MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection
38RIESGO
abrir ↗
Referência
CVE-2026-9514
CVE-2026-9514MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection
38RIESGO
abrir ↗
Referência
CVE-2014-9098
CVE-2014-9098—
Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin
23RIESGO
abrir ↗
← anteriorpágina 450 / 744siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.