Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.899exploits catalogados
35.840CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.600GitHub PoC 14.322VulnCheck XDB 8722Nuclei 4320Metasploit 3477✓ solo verificadosrecientespopularesriesgo
22.549 exploits
Referência
CVE-2009-3190
CVE-2009-3190—
Multiple SQL injection vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2015-1701
CVE-2015-1701HIGHbajo ataqueransomware
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local
98RIESGO
abrir ↗
Referência
CVE-2023-0600
CVE-2023-0600CRITICAL
WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
63RIESGO
abrir ↗
Referência
CVE-2009-3244
CVE-2009-3244—
Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remo
28RIESGO
abrir ↗
Referência
CVE-2009-3250
CVE-2009-3250—
The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated u
28RIESGO
abrir ↗
Referência
CVE-2009-3311
CVE-2009-3311—
Cross-site scripting (XSS) vulnerability in index.php in RSSMediaScript allows remote attackers to inject arbitrary web
23RIESGO
abrir ↗
Referência
CVE-2009-3324
CVE-2009-3324—
PHP remote file inclusion vulnerability in include/prodler.class.php in ProdLer 2.0 and earlier allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2026-41940
CVE-2026-41940CRITICALbajo ataqueransomware
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RIESGO
abrir ↗
Referência
CVE-2017-8917
CVE-2017-8917—
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspeci
60RIESGO
abrir ↗
Referência
CVE-2009-3593
CVE-2009-3593—
Multiple cross-site scripting (XSS) vulnerabilities in Freelancers 1.0 allow remote attackers to inject arbitrary web sc
23RIESGO
abrir ↗
Referência
CVE-2009-3599
CVE-2009-3599—
Cross-site scripting (XSS) vulnerability in single_winner1.php in HUBScript 1.0 allows remote attackers to inject arbitr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Microsoft DNS Server - Dynamic DNS Update/Change
CVE-2007-1644—remotewindows
The dynamic DNS update mechanism in the DNS Server service on Microsoft Windows does not properly authenticate clients i
35RIESGO
abrir ↗
Referência✓ VexDay Proof
0irc-client 1345 build20060823 - Denial of Service
CVE-2007-1648—doswindows
0irc 1345 build 20060823 allows remote attackers to cause a denial of service (application crash) by operating an IRC se
23RIESGO
abrir ↗
Referência
CVE-2025-34103
CVE-2025-34103CRITICAL
WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi
63RIESGO
abrir ↗
Referência
CVE-2009-3661
CVE-2009-3661—
Multiple SQL injection vulnerabilities in the DJ-Catalog (com_djcatalog) component for Joomla! allow remote attackers to
23RIESGO
abrir ↗
Referência
CVE-2014-2623
CVE-2014-2623—
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
60RIESGO
abrir ↗
Referência
CVE-2014-2671
CVE-2014-2671—
Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corrupt
35RIESGO
abrir ↗
Referência
CVE-2014-2671
CVE-2014-2671—
Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corrupt
35RIESGO
abrir ↗
Referência
CVE-2009-3669
CVE-2009-3669—
SQL injection vulnerability in the foobla Suggestions (com_foobla_suggestions) component 1.5.11 for Joomla! allows remot
23RIESGO
abrir ↗
Referência
CVE-2009-4929
CVE-2009-4929—
admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attacker
23RIESGO
abrir ↗
Referência
CVE-2022-1040
CVE-2022-1040CRITICALbajo ataque
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sopho
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Mambo Module Calendar (Agenda) 1.5.5 - Remote File Inclusion
CVE-2007-2049—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Calendar Module (com_calendar) 1.5.5 for Mambo allow remote at
23RIESGO
abrir ↗
Referência
CVE-2020-7961
CVE-2020-7961CRITICALbajo ataque
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RIESGO
abrir ↗
Referência
CVE-2020-7961
CVE-2020-7961CRITICALbajo ataque
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RIESGO
abrir ↗
Referência
CVE-2021-31207
CVE-2021-31207MEDIUMbajo ataqueransomware
Microsoft Exchange Server Security Feature Bypass Vulnerability
100RIESGO
abrir ↗
Referência
CVE-2025-34103
CVE-2025-34103CRITICAL
WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi
63RIESGO
abrir ↗
Referência
CVE-2026-6381
CVE-2026-6381HIGH
WP Maps < 4.9.3 - Subscriber+ Local File Inclusion
41RIESGO
abrir ↗
Referência✓ VexDay Proof
RicarGBooK 1.2.1 - 'lang' Local File Inclusion
CVE-2007-2050—webappsphp
Multiple directory traversal vulnerabilities in header.php in RicarGBooK 1.2.1 allow remote attackers to include and exe
23RIESGO
abrir ↗
Referência
CVE-2026-6379
CVE-2026-6379HIGH
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter
41RIESGO
abrir ↗
Referência
CVE-2009-3808
CVE-2009-3808—
MixSense DJ Studio 1.0.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute
23RIESGO
abrir ↗
← anteriorpágina 607 / 752siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.