Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.772exploits catalogados

35.760CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.455Referência 22.523GitHub PoC 14.289VulnCheck XDB 8710Nuclei 4319Metasploit 3476✓ solo verificadosrecientes populares riesgo

22.492 exploits

Referência✓ VexDay Proof

WebBuilder 2.0 - 'StageLoader.php' Remote File Inclusion

CVE-2007-0703—webappsphp

PHP remote file inclusion vulnerability in library/StageLoader.php in WebBuilder 2.0 and earlier allows remote attackers

23RIESGO

abrir ↗

Referência

CVE-2009-3423

CVE-2009-3423—

23RIESGO

abrir ↗

Referência

CVE-2019-12745

CVE-2019-12745—

out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.

23RIESGO

abrir ↗

Referência

CVE-2013-3524

CVE-2013-3524—

SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remot

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Ninja Blog 4.8 - Remote Information Disclosure

CVE-2009-0325—webappsphp

Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remo

23RIESGO

abrir ↗

Referência

CVE-2018-10366

CVE-2018-10366—

An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the nam

23RIESGO

abrir ↗

Referência

CVE-2008-5943

CVE-2008-5943—

Multiple directory traversal vulnerabilities in NavBoard 16 (2.6.0) allow remote attackers to include and execute arbitr

23RIESGO

abrir ↗

Referência✓ VexDay Proof

phpYabs 0.1.2 - 'Azione' Remote File Inclusion

CVE-2009-0639—webappsphp

PHP remote file inclusion vulnerability in moduli/libri/index.php in phpyabs 0.1.2 allows remote attackers to execute ar

23RIESGO

abrir ↗

Referência✓ VexDay Proof

PhpCommander 3.0 - 'upload' Remote Code Execution

CVE-2006-4636—webappsphp

Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute a

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Polaring 0.04.03 - 'general.php' Remote File Inclusion

CVE-2006-5078—webappsphp

PHP remote file inclusion vulnerability in view/general.php in Kristian Niemi Polaring 00.04.03 and earlier allows remot

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Somery 0.4.6 - 'skin_dir' Remote File Inclusion

CVE-2007-0704—webappsphp

PHP remote file inclusion vulnerability in install.php in Somery 0.4.6 allows remote attackers to execute arbitrary PHP

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Webavis 0.1.1 - 'class.php?root' Remote File Inclusion

CVE-2007-2943—webappsphp

PHP remote file inclusion vulnerability in class/class.php in Webavis 0.1.1 allows remote attackers to execute arbitrary

23RIESGO

abrir ↗

Referência✓ VexDay Proof

LimeSurvey 1.52 - 'language.php' Remote File Inclusion

CVE-2007-5573—webappsphp

PHP remote file inclusion vulnerability in classes/core/language.php in LimeSurvey 1.5.2 and earlier allows remote attac

23RIESGO

abrir ↗

Referência✓ VexDay Proof

shibby shop 2.2 - Multiple Vulnerabilities

CVE-2008-2872—webappsphp

SQL injection vulnerability in default.asp in sHibby sHop 2.2 and earlier allows remote attackers to execute arbitrary S

23RIESGO

abrir ↗

Referência✓ VexDay Proof

shibby shop 2.2 - Multiple Vulnerabilities

CVE-2008-2873—webappsphp

sHibby sHop 2.2 and earlier stores sensitive information under the web root with insufficient access control, which allo

23RIESGO

abrir ↗

Referência

CVE-2014-5520

CVE-2014-5520—

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via

23RIESGO

abrir ↗

Referência

CVE-2022-40797

CVE-2022-40797CRITICAL

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.

48RIESGO

abrir ↗

Referência

CVE-2014-3871

CVE-2014-3871—

Multiple SQL injection vulnerabilities in register.php in Geodesic Solutions GeoCore MAX 7.3.3 (formerly GeoClassifieds

23RIESGO

abrir ↗

Referência

CVE-2020-5147

CVE-2020-5147—

SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to

23RIESGO

abrir ↗

Referência

CVE-2012-4998

CVE-2012-4998—

Cross-site scripting (XSS) vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script

23RIESGO

abrir ↗

Referência

CVE-2008-0843

CVE-2008-0843—

StatCounteX 3.0 and 3.1 allows remote attackers to obtain sensitive information and edit configuration scripts via a dir

23RIESGO

abrir ↗

Referência

CVE-2008-0843

CVE-2008-0843—

StatCounteX 3.0 and 3.1 allows remote attackers to obtain sensitive information and edit configuration scripts via a dir

23RIESGO

abrir ↗

Referência

CVE-2016-3652

CVE-2016-3652—

Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM)

23RIESGO

abrir ↗

Referência✓ VexDay Proof

PHPAuctionSystem - Insecure Cookie Handling

CVE-2009-0108—webappsphp

PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via m

23RIESGO

abrir ↗

Referência

CVE-2009-4447

CVE-2009-4447—

Jax Guestbook 3.5.0 allows remote attackers to bypass authentication and modify administrator settings via a direct requ

23RIESGO

abrir ↗

Referência

CVE-2016-1000124

CVE-2016-1000124—

Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6

23RIESGO

abrir ↗

Referência

CVE-2015-6512

CVE-2015-6512—

SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows

23RIESGO

abrir ↗

Referência✓ VexDay Proof

Online Fantasy Football League (OFFL) 0.2.6 - 'teams.php' SQL Injection

CVE-2008-2890—webappsphp

Multiple SQL injection vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 and earlier allow remote attackers

23RIESGO

abrir ↗

Referência

CVE-2011-4674

CVE-2011-4674—

SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows rem

23RIESGO

abrir ↗

Referência

CVE-2019-16531

CVE-2019-16531—

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.