Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.724exploits catalogados

35.724CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.455Referência 22.492GitHub PoC 14.286VulnCheck XDB 8703Nuclei 4314Metasploit 3474✓ solo verificadosrecientes populares riesgo

22.407 exploits

Referência

CVE-2017-1000486

CVE-2017-1000486CRITICALbajo ataque

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

100RIESGO

abrir ↗

Referência

CVE-2022-31470

CVE-2022-31470—

An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12

50RIESGO

abrir ↗

Referência

CVE-2009-3446

CVE-2009-3446—

SQL injection vulnerability in the MyRemote Video Gallery (com_mytube) component 1.0 Beta for Joomla! allows remote atta

23RIESGO

abrir ↗

Referência

CVE-2010-1622

CVE-2010-1622—

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote at

35RIESGO

abrir ↗

Referência

CVE-2019-13068

CVE-2019-13068—

public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the

35RIESGO

abrir ↗

Referência

CVE-2011-4075

CVE-2011-4075—

The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary

50RIESGO

abrir ↗

Referência

CVE-2025-40552

CVE-2025-40552CRITICAL

SolarWinds Web Help Desk Authentication Bypass Vulnerability

75RIESGO

abrir ↗

Referência

CVE-2011-0522

CVE-2011-0522—

The StripTags function in (1) the USF decoder (modules/codec/subtitles/subsdec.c) and (2) the Text decoder (modules/code

35RIESGO

abrir ↗

Referência

CVE-2014-9308

CVE-2014-9308—

Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka Wor

50RIESGO

abrir ↗

Referência

CVE-2014-9308

CVE-2014-9308—

Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka Wor

50RIESGO

abrir ↗

Referência

CVE-2013-1408

CVE-2013-1408—

Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenti

23RIESGO

abrir ↗

Referência

CVE-2017-8731

CVE-2017-8731—

Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the

35RIESGO

abrir ↗

Referência

CVE-2016-2388

CVE-2016-2388MEDIUMbajo ataque

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor

75RIESGO

abrir ↗

Referência

CVE-2016-2388

CVE-2016-2388MEDIUMbajo ataque

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor

75RIESGO

abrir ↗

Referência

CVE-2016-2388

CVE-2016-2388MEDIUMbajo ataque

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor

75RIESGO

abrir ↗

Referência

CVE-2016-2388

CVE-2016-2388MEDIUMbajo ataque

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor

75RIESGO

abrir ↗

Referência

CVE-2016-8740

CVE-2016-8740—

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2

45RIESGO

abrir ↗

Referência

CVE-2009-2638

CVE-2009-2638—

SQL injection vulnerability in the AkoBook (com_akobook) component 2.3 for Joomla! allows remote attackers to execute ar

23RIESGO

abrir ↗

Referência

CVE-2017-16720

CVE-2017-16720—

A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within th

35RIESGO

abrir ↗

Referência

CVE-2017-11890

CVE-2017-11890—

Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Win

35RIESGO

abrir ↗

Referência

CVE-2018-16323

CVE-2018-16323—

ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that ha

35RIESGO

abrir ↗

Referência

CVE-2016-4010

CVE-2016-4010—

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary

60RIESGO

abrir ↗

Referência✓ VexDay Proof

SAPID CMF Build 87 - 'last_module' Remote Code Execution

CVE-2007-5056—webappsphp

Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including

28RIESGO

abrir ↗

Referência

Comtrend VR-3033 - Command Injection

CVE-2020-10173—webappshardware

Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabiliti

45RIESGO

abrir ↗

Referência

CVE-2016-0170

CVE-2016-0170—

GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

35RIESGO

abrir ↗

Referência

CVE-2020-16009

CVE-2020-16009HIGHbajo ataque

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl

83RIESGO

abrir ↗

Referência

CVE-2018-14392

CVE-2018-14392—

The New Threads plugin before 1.2 for MyBB has XSS.

35RIESGO

abrir ↗

Referência

CVE-2009-3642

CVE-2009-3642—

Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to exe

23RIESGO

abrir ↗

Referência

CVE-2023-4547

CVE-2023-4547LOW

SPA-Cart eCommerce CMS search cross site scripting

55RIESGO

abrir ↗

Referência

CVE-2017-9232

CVE-2017-9232—

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate pe

50RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.