Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

77.900exploits catalogados
35.840CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.600GitHub PoC 14.323VulnCheck XDB 8722Nuclei 4320Metasploit 3477✓ solo verificadosrecientespopularesriesgo
22.573 exploits
Referência✓ VexDay Proof
Mambo Module Calendar (Agenda) 1.5.5 - Remote File Inclusion
CVE-2007-2049—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Calendar Module (com_calendar) 1.5.5 for Mambo allow remote at
23RIESGO
abrir ↗
Referência
CVE-2025-34103
CVE-2025-34103CRITICAL
WePresent WiPG-1000 Unauthenticated Command Injection in via rdfs.cgi
63RIESGO
abrir ↗
Referência
CVE-2026-6381
CVE-2026-6381HIGH
WP Maps < 4.9.3 - Subscriber+ Local File Inclusion
41RIESGO
abrir ↗
Referência✓ VexDay Proof
RicarGBooK 1.2.1 - 'lang' Local File Inclusion
CVE-2007-2050—webappsphp
Multiple directory traversal vulnerabilities in header.php in RicarGBooK 1.2.1 allow remote attackers to include and exe
23RIESGO
abrir ↗
Referência
CVE-2026-6379
CVE-2026-6379HIGH
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter
41RIESGO
abrir ↗
Referência
CVE-2009-3808
CVE-2009-3808—
MixSense DJ Studio 1.0.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute
23RIESGO
abrir ↗
Referência
CVE-2009-3835
CVE-2009-3835—
SQL injection vulnerability in the JShop (com_jshop) component for Joomla! allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência
CVE-2024-9465
CVE-2024-9465CRITICALbajo ataque
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
100RIESGO
abrir ↗
Referência
CVE-2009-4221
CVE-2009-4221—
SQL injection vulnerability in classified.php in phpBazar 2.1.1fix and earlier allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2020-16846
CVE-2020-16846CRITICALbajo ataque
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH clien
100RIESGO
abrir ↗
Referência
CVE-2009-4223
CVE-2009-4223—
PHP remote file inclusion vulnerability in adm/krgourl.php in KR-Web 1.1b2 and earlier allows remote attackers to execut
50RIESGO
abrir ↗
Referência
CVE-2015-3313
CVE-2015-3313—
SQL injection vulnerability in WordPress Community Events plugin before 1.4.
23RIESGO
abrir ↗
Referência
CVE-2009-4989
CVE-2009-4989—
Cross-site scripting (XSS) vulnerability in index.php in AJ Auction Pro OOPD 3.0 allows remote attackers to inject arbit
23RIESGO
abrir ↗
Referência
CVE-2012-0698
CVE-2012-0698—
tcsd in TrouSerS before 0.3.10 allows remote attackers to cause a denial of service (daemon crash) via a crafted type_of
28RIESGO
abrir ↗
Referência
CVE-2026-19712
CVE-2026-19712MEDIUM
Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description
33RIESGO
abrir ↗
Referência
CVE-2026-19711
CVE-2026-19711MEDIUM
Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request
33RIESGO
abrir ↗
Referência
CVE-2026-19613
CVE-2026-19613MEDIUM
ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source
33RIESGO
abrir ↗
Referência
CVE-2026-18653
CVE-2026-18653HIGH
WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter
41RIESGO
abrir ↗
Referência
CVE-2026-17533
CVE-2026-17533HIGH
All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import
41RIESGO
abrir ↗
Referência
CVE-2026-15384
CVE-2026-15384MEDIUM
Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR
33RIESGO
abrir ↗
Referência
CVE-2026-13712
CVE-2026-13712MEDIUM
Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL
33RIESGO
abrir ↗
Referência
CVE-2026-19934
CVE-2026-19934MEDIUM
itsourcecode Hospital Management System vieworder.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2010-1952
CVE-2010-1952—
Directory traversal vulnerability in the BeeHeard (com_beeheard) and BeeHeard Lite (com_beeheardlite) component 1.0 for
43RIESGO
abrir ↗
Referência
CVE-2026-19918
CVE-2026-19918MEDIUM
SpaceX Starlink Router Gen 3 gRPC Management get_status access control
33RIESGO
abrir ↗
Referência
CVE-2026-19075
CVE-2026-19075MEDIUM
All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-19074
CVE-2026-19074MEDIUM
Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure
33RIESGO
abrir ↗
Referência
Sphider Search Engine - Multiple Vulnerabilities
CVE-2014-5081—webappsphp
sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass
28RIESGO
abrir ↗
Referência
CVE-2026-18960
CVE-2026-18960MEDIUM
Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords
33RIESGO
abrir ↗
Referência
CVE-2026-18946
CVE-2026-18946HIGH
Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename
41RIESGO
abrir ↗
Referência
CVE-2026-18934
CVE-2026-18934MEDIUM
RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion
33RIESGO
abrir ↗
← anteriorpágina 613 / 753siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.