Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.866exploits catalogados
35.812CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.573GitHub PoC 14.316VulnCheck XDB 8722Nuclei 4320Metasploit 3477✓ solo verificadosrecientespopularesriesgo
22.549 exploits
Referência✓ VexDay Proof
Merlix Teamworx Server - File Disclosure/Bypass
CVE-2008-5599—webappsphp
SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL co
23RIESGO
abrir ↗
Referência
CVE-2023-4966
CVE-2023-4966CRITICALbajo ataqueransomware
Unauthenticated sensitive information disclosure
100RIESGO
abrir ↗
Referência✓ VexDay Proof
QMail Mailing List Manager 1.2 - Database Disclosure
CVE-2008-5606—webappsasp
Gazatem QMail Mailing List Manager 1.2 stores sensitive information under the web root with insufficient access control,
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Kusaba 1.0.4 - Remote Code Execution (1)
CVE-2008-5663—webappsphp
Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execut
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Kusaba 1.0.4 - Remote Code Execution (2)
CVE-2008-5663—webappsphp
Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execut
23RIESGO
abrir ↗
Referência✓ VexDay Proof
XOOPS Module xhresim - SQL Injection
CVE-2008-5665—webappsphp
SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Referência
CVE-2014-5201
CVE-2014-5201—
SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2008-6104
CVE-2008-6104—
SQL injection vulnerability in A4Desk PHP Event Calendar allows remote attackers to execute arbitrary SQL commands via t
23RIESGO
abrir ↗
Referência
CVE-2008-6132
CVE-2008-6132—
Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allo
43RIESGO
abrir ↗
Referência
CVE-2008-6132
CVE-2008-6132—
Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allo
43RIESGO
abrir ↗
Referência✓ VexDay Proof
BMForum 5.6 - 'tagname' SQL Injection
CVE-2008-6091—webappsphp
SQL injection vulnerability in plugins.php in BMForum 5.6, when magic_quotes_gpc is disabled, allows remote attackers to
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpscripts Ranking Script - Insecure Cookie Handling
CVE-2008-6092—webappsphp
phpscripts Ranking Script allows remote attackers to bypass authentication and gain administrative access by sending an
23RIESGO
abrir ↗
Referência
CVE-2009-4540
CVE-2009-4540—
SQL injection vulnerability in page.php in Mini CMS 1.0.1 allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Noname CMS 1.0 - Multiple SQL Injections
CVE-2008-6093—webappsphp
SQL injection vulnerability in index.php in Noname CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers t
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Discussion Forums 2k 3.3 - Multiple SQL Injections
CVE-2008-6100—webappsphp
Multiple SQL injection vulnerabilities in Discussion Forums 2k 3.3, when magic_quotes_gpc is disabled, allow remote atta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Goople CMS 1.7 - Insecure Cookie Handling
CVE-2008-6118—webappsphp
win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Full PHP Emlak Script - 'arsaprint.php' SQL Injection
CVE-2008-6133—webappsphp
SQL injection vulnerability in arsaprint.php in Full PHP Emlak Script allows remote attackers to execute arbitrary SQL c
23RIESGO
abrir ↗
Referência✓ VexDay Proof
JW Player - 'playerready' Cross-Site Scripting
CVE-2012-3351—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Flexphpic 0.0.x - Authentication Bypass
CVE-2008-6142—webappsphp
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPic 0.0.4 and FlexPHPic Pro 0.0.3, and other 0.0.
23RIESGO
abrir ↗
Referência
CVE-2012-2910
CVE-2012-2910—
Multiple cross-site scripting (XSS) vulnerabilities in SiliSoftware phpThumb() 1.7.11 allow remote attackers to inject a
23RIESGO
abrir ↗
Referência
CVE-2012-2917
CVE-2012-2917—
Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2012-2941
CVE-2012-2941—
Cross-site scripting (XSS) vulnerability in search/ in Yandex.Server 2010 9.0 Enterprise allows remote attackers to inje
23RIESGO
abrir ↗
Referência
CVE-2009-4562
CVE-2009-4562—
Cross-site scripting (XSS) vulnerability in zp-core/admin.php in Zenphoto 1.2.5 allows remote attackers to inject arbitr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Megacubo 5.0.7 - 'mega://' Remote 'eval()' Injection
CVE-2008-6748—remotewindows
Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the
23RIESGO
abrir ↗
Referência
CVE-2009-4564
CVE-2009-4564—
SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers
23RIESGO
abrir ↗
Referência✓ VexDay Proof
yourplace 1.0.2 - Multiple Vulnerabilities / Remote Code Execution
CVE-2008-6771—webappsphp
YourPlace 1.0.2 and earlier allows remote attackers to obtain sensitive system information via a direct request via a di
23RIESGO
abrir ↗
Referência✓ VexDay Proof
SFS EZ Affiliate - 'cat_id' SQL Injection
CVE-2008-6780—webappsphp
SQL injection vulnerability in directory.php in Scripts for Sites (SFS) SFS EZ Affiliate allows remote attackers to exec
23RIESGO
abrir ↗
Referência✓ VexDay Proof
SFS EZ Gaming Directory - 'cat_id' SQL Injection
CVE-2008-6781—webappsphp
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to exec
23RIESGO
abrir ↗
Referência✓ VexDay Proof
SFS EZ Gaming Directory - 'directory.php' SQL Injection
CVE-2008-6781—webappsphp
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to exec
23RIESGO
abrir ↗
Referência
CVE-2012-5292
CVE-2012-5292—
Multiple SQL injection vulnerabilities in Atar2b CMS 4.0.1 allow remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
← anteriorpágina 595 / 752siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.