Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.620exploits catalogados

35.647CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.455Referência 22.429GitHub PoC 14.270VulnCheck XDB 8693Nuclei 4299Metasploit 3474✓ solo verificadosrecientes populares riesgo

22.407 exploits

Referência

CVE-2009-2779

CVE-2009-2779—

SQL injection vulnerability in index.php in AJ Matrix DNA allows remote attackers to execute arbitrary SQL commands via

23RIESGO

abrir ↗

Referência

CVE-2009-2781

CVE-2009-2781—

SQL injection vulnerability in forum.php in Arab Portal 2.x, when magic_quotes_gpc is disabled, allows remote authentica

23RIESGO

abrir ↗

Referência

CVE-2009-2891

CVE-2009-2891—

SQL injection vulnerability in list.php in PHP Scripts Now Riddles allows remote attackers to execute arbitrary SQL comm

23RIESGO

abrir ↗

Referência

CVE-2016-6909

CVE-2016-6909—

Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9

35RIESGO

abrir ↗

Referência

CVE-2017-8682

CVE-2017-8682—

Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a

35RIESGO

abrir ↗

Referência

CVE-2009-2895

CVE-2009-2895—

SQL injection vulnerability in rss.php in Ultimate Regnow Affiliate (URA) 3.0 allows remote attackers to execute arbitra

23RIESGO

abrir ↗

Referência

CVE-2017-16720

CVE-2017-16720—

A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within th

35RIESGO

abrir ↗

Referência

CVE-2017-11890

CVE-2017-11890—

Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Win

35RIESGO

abrir ↗

Referência

CVE-2018-16323

CVE-2018-16323—

ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that ha

35RIESGO

abrir ↗

Referência

CVE-2016-4010

CVE-2016-4010—

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary

60RIESGO

abrir ↗

Referência✓ VexDay Proof

SAPID CMF Build 87 - 'last_module' Remote Code Execution

CVE-2007-5056—webappsphp

Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including

28RIESGO

abrir ↗

Referência

Comtrend VR-3033 - Command Injection

CVE-2020-10173—webappshardware

Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabiliti

45RIESGO

abrir ↗

Referência

CVE-2016-0170

CVE-2016-0170—

GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

35RIESGO

abrir ↗

Referência

CVE-2020-16009

CVE-2020-16009HIGHbajo ataque

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl

83RIESGO

abrir ↗

Referência

CVE-2018-14392

CVE-2018-14392—

The New Threads plugin before 1.2 for MyBB has XSS.

35RIESGO

abrir ↗

Referência

CVE-2009-3642

CVE-2009-3642—

Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to exe

23RIESGO

abrir ↗

Referência

CVE-2023-4547

CVE-2023-4547LOW

SPA-Cart eCommerce CMS search cross site scripting

55RIESGO

abrir ↗

Referência

CVE-2017-9232

CVE-2017-9232—

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate pe

50RIESGO

abrir ↗

Referência

CVE-2021-40875

CVE-2021-40875—

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat ac

50RIESGO

abrir ↗

Referência

CVE-2009-0182

CVE-2009-0182—

Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in

50RIESGO

abrir ↗

Referência

CVE-2025-48828

CVE-2025-48828CRITICAL

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the t

75RIESGO

abrir ↗

Referência✓ VexDay Proof

Bitweaver 2.6 - 'saveFeed()' Remote Code Execution

CVE-2009-1669—webappsphp

The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers

28RIESGO

abrir ↗

Referência

CVE-2013-3563

CVE-2013-3563—

Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a de

50RIESGO

abrir ↗

Referência✓ VexDay Proof

Xitami Web Server 2.5 - 'If-Modified-Since' Remote Buffer Overflow

CVE-2007-5067—remotewindows

Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long

60RIESGO

abrir ↗

Referência

CVE-2020-11022

CVE-2020-11022MEDIUM

jQuery has a potential XSS vulnerability

55RIESGO

abrir ↗

Referência

CVE-2020-11022

CVE-2020-11022MEDIUM

jQuery has a potential XSS vulnerability

55RIESGO

abrir ↗

Referência

CVE-2023-50919

CVE-2023-50919CRITICAL

An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string

75RIESGO

abrir ↗

Referência

CVE-2014-9566

CVE-2014-9566—

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

50RIESGO

abrir ↗

Referência

CVE-2014-9566

CVE-2014-9566—

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

50RIESGO

abrir ↗

Referência

CVE-2012-3569

CVE-2012-3569—

Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Pl

50RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.