Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.813exploits catalogados
35.788CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.455Referência 22.549GitHub PoC 14.290VulnCheck XDB 8722Nuclei 4320Metasploit 3477✓ solo verificadosrecientespopularesriesgo
22.549 exploits
Referência
CVE-2011-4671
CVE-2011-4671—
SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8,
23RIESGO
abrir ↗
Referência
CVE-2017-17110
CVE-2017-17110—
Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.
23RIESGO
abrir ↗
Referência
CVE-2023-27290
CVE-2023-27290CRITICAL
IBM Observability with Instana missing authentication
48RIESGO
abrir ↗
Referência
CVE-2015-7715
CVE-2015-7715—
Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows
23RIESGO
abrir ↗
Referência
CVE-2015-7715
CVE-2015-7715—
Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows
23RIESGO
abrir ↗
Referência✓ VexDay Proof
OWLLib 1.0 - 'OWLMemoryProperty.php' Remote File Inclusion
CVE-2006-6150—webappsphp
PHP remote file inclusion vulnerability in memory/OWLMemoryProperty.php in OWLLib 1.0 allows remote attackers to execute
23RIESGO
abrir ↗
Referência✓ VexDay Proof
BrowseDialog Class - 'ccrpbds6.dll' Multiple Denial of Service Vulnerabilities
CVE-2007-1162—doswindows
A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allo
23RIESGO
abrir ↗
Referência
CVE-2026-66007
CVE-2026-66007MEDIUM
Datasets Path Traversal via Unsanitized file_name Metadata
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PHP-Nuke - 'iframe.php' Remote File Inclusion
CVE-2007-1626—webappsphp
PHP remote file inclusion vulnerability in iframe.php in the iFrame Module for PHP-NUKE allows remote attackers to execu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Hot Links SQL-PHP 3 - 'report.php' Multiple Vulnerabilities
CVE-2008-4379—webappsphp
Cross-site scripting (XSS) vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote at
23RIESGO
abrir ↗
Referência
CVE-2026-65917
CVE-2026-65917HIGH
CyberPanel IncBackups IDOR via Sequential Backup ID
41RIESGO
abrir ↗
Referência
CVE-2026-9577
CVE-2026-9577MEDIUM
Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter
33RIESGO
abrir ↗
Referência
CVE-2012-0277
CVE-2012-0277—
Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash
23RIESGO
abrir ↗
Referência
CVE-2026-8986
CVE-2026-8986CRITICAL
Command Injection via Malicious OCPP Server
48RIESGO
abrir ↗
Referência
CVE-2026-8985
CVE-2026-8985CRITICAL
Unauthenticated Command Injection
48RIESGO
abrir ↗
Referência
CVE-2026-8984
CVE-2026-8984CRITICAL
Unauthenticated RCE
48RIESGO
abrir ↗
Referência
CVE-2026-8983
CVE-2026-8983CRITICAL
Backdoor Authentication Token
48RIESGO
abrir ↗
Referência
CVE-2026-16334
CVE-2026-16334MEDIUM
itsourcecode Hospital Management System prescriptionorder.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-16332
CVE-2026-16332MEDIUM
D-Link DNS-320 multi_uploadify.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-13432
CVE-2026-13432MEDIUM
ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation
33RIESGO
abrir ↗
Referência
CVE-2026-13156
CVE-2026-13156MEDIUM
MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF
33RIESGO
abrir ↗
Referência
CVE-2026-12972
CVE-2026-12972MEDIUM
PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering
33RIESGO
abrir ↗
Referência
CVE-2026-12898
CVE-2026-12898MEDIUM
All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal
33RIESGO
abrir ↗
Referência
CVE-2017-14848
CVE-2017-14848—
WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.
23RIESGO
abrir ↗
Referência
CVE-2009-2395
CVE-2009-2395—
SQL injection vulnerability in the K2 (com_k2) component 1.0.1 Beta and earlier for Joomla! allows remote attackers to e
23RIESGO
abrir ↗
Referência
CVE-2009-3601
CVE-2009-3601—
Cross-site scripting (XSS) vulnerability in demo_page.php in Scriptsez Ultimate Poll allows remote attackers to inject a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Ez Ringtone Manager - Multiple Remote File Disclosure Vulnerabilities
CVE-2008-6112—webappsphp
Multiple directory traversal vulnerabilities in Ez Ringtone Manager allow remote attackers to read arbitrary files via a
23RIESGO
abrir ↗
Referência
CVE-2018-11415
CVE-2018-11415—
SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: th
23RIESGO
abrir ↗
Referência
CVE-2004-1521
CVE-2004-1521—
Eudora 6.2.0.14 does not issue a warning when a user forwards an e-mail message that contains base64 or quoted-printable
23RIESGO
abrir ↗
Referência✓ VexDay Proof
PHPFootball 1.6 - Remote Database Disclosure
CVE-2007-0638—webappsphp
show.php in Vlad Alexa Mancini PHPFootball 1.6 allows remote attackers to obtain sensitive information (database content
23RIESGO
abrir ↗
← anteriorpágina 588 / 752siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.