Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.866exploits catalogados
35.812CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.573GitHub PoC 14.316VulnCheck XDB 8722Nuclei 4320Metasploit 3477✓ solo verificadosrecientespopularesriesgo
22.549 exploits
Referência
CVE-2012-2941
CVE-2012-2941—
Cross-site scripting (XSS) vulnerability in search/ in Yandex.Server 2010 9.0 Enterprise allows remote attackers to inje
23RIESGO
abrir ↗
Referência
CVE-2014-6242
CVE-2014-6242—
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow
23RIESGO
abrir ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALbajo ataque
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALbajo ataque
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗
Referência
CVE-2009-4560
CVE-2009-4560—
SQL injection vulnerability in profile.php in WebLeague 2.2.0 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALbajo ataque
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗
Referência
CVE-2009-4561
CVE-2009-4561—
Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magic_quotes_gpc is disabled, allow r
23RIESGO
abrir ↗
Referência
CVE-2012-4865
CVE-2012-4865—
Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file.
23RIESGO
abrir ↗
Referência
CVE-2009-4569
CVE-2009-4569—
SQL injection vulnerability in elkagroup Image Gallery allows remote attackers to execute arbitrary SQL commands via the
23RIESGO
abrir ↗
Referência
CVE-2009-4569
CVE-2009-4569—
SQL injection vulnerability in elkagroup Image Gallery allows remote attackers to execute arbitrary SQL commands via the
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Fonality trixbox - 'langChoice' Local File Inclusion (connect-back) (2)
CVE-2008-6825—webappslinux
Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to
43RIESGO
abrir ↗
Referência✓ VexDay Proof
DataTrac Activity Console - Denial of Service
CVE-2005-1667—doswindows
DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request.
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Fuzzylime CMS 3.01 - 'commrss.php' Remote Code Execution
CVE-2008-6833—webappsphp
Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and
23RIESGO
abrir ↗
Referência✓ VexDay Proof
p4CMS 1.05 - 'abs_pfad' Remote File Inclusion
CVE-2006-4769—webappsphp
PHP remote file inclusion vulnerability in abf_js.php in p4CMS 1.05 allows remote attackers to execute arbitrary PHP cod
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MiniPort@l 0.1.5 Beta - 'skiny' Remote File Inclusion
CVE-2006-4770—webappsphp
PHP remote file inclusion vulnerability in menu.php in MiniPort@l 2.0 and earlier allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Fuzzylime CMS 3.01a - 'file' Local File Inclusion
CVE-2008-6834—webappsphp
Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.01 and 3.01a allow remote attackers to include and exe
23RIESGO
abrir ↗
Referência
CVE-2012-5312
CVE-2012-5312—
SQL injection vulnerability in Tribiq CMS allows remote attackers to execute arbitrary SQL commands via the id parameter
23RIESGO
abrir ↗
Referência
CVE-2012-5315
CVE-2012-5315—
Multiple cross-site scripting (XSS) vulnerabilities in php ireport 1.0 allow remote attackers to inject arbitrary web sc
23RIESGO
abrir ↗
Referência
CVE-2012-5322
CVE-2012-5322—
Multiple cross-site scripting (XSS) vulnerabilities in Xavi X7968 allow remote attackers to inject arbitrary web script
23RIESGO
abrir ↗
Referência
CVE-2026-12183
CVE-2026-12183CRITICAL
Nefteprodukttekhnika BUK TS-G Gas Station Automation System Authentication Bypass via ajax-login.php Accepting Arbitrary Credentials
48RIESGO
abrir ↗
Referência
CVE-2026-12066
CVE-2026-12066MEDIUM
PbootCMS Password MemberController.php retrieve password recovery
33RIESGO
abrir ↗
Referência
CVE-2026-8589
CVE-2026-8589HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RIESGO
abrir ↗
Referência
CVE-2026-25860
CVE-2026-25860MEDIUM
OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler
33RIESGO
abrir ↗
Referência
CVE-2026-25860 POC git
CVE-2026-25860MEDIUM
OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler
33RIESGO
abrir ↗
Referência
CVE-2026-34417
CVE-2026-34417MEDIUM
OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php
33RIESGO
abrir ↗
Referência
CVE-2026-34416
CVE-2026-34416MEDIUM
OSCAL-GUI Reflected XSS via project parameter in oscal.php
33RIESGO
abrir ↗
Referência
CVE-2017-20250
CVE-2017-20250HIGH
WordPress Plugin Mac Photo Gallery 3.0 Arbitrary File Download
41RIESGO
abrir ↗
Referência
CVE-2025-55651
CVE-2025-55651MEDIUM
A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows
33RIESGO
abrir ↗
Referência
CVE-2026-11582
CVE-2026-11582MEDIUM
CodeAstro Student Attendance Management System index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-11559
CVE-2026-11559MEDIUM
CodeAstro Payroll System view_account.php sql injection
33RIESGO
abrir ↗
← anteriorpágina 600 / 752siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.