Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.056exploits catalogados
35.925CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.640GitHub PoC 14.392VulnCheck XDB 8755Nuclei 4333Metasploit 3478✓ solo verificadosrecientespopularesriesgo
22.600 exploits
Referência
CVE-2026-5316
CVE-2026-5316MEDIUM
Nothings stb stb_vorbis.c setup_free allocation of resources
33RIESGO
abrir ↗
Referência
CVE-2019-10847
CVE-2019-10847—
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.
23RIESGO
abrir ↗
Referência
CVE-2009-2558
CVE-2009-2558—
system/message.php in Admin News Tools 2.5 does not properly restrict access, which allows remote attackers to post news
23RIESGO
abrir ↗
Referência
CVE-2009-4106
CVE-2009-4106—
Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2010-2850
CVE-2010-2850—
Directory traversal vulnerability in productionnu2/fileuploader.php in nuBuilder 10.04.20, and possibly other versions b
23RIESGO
abrir ↗
Referência
CVE-2009-4674
CVE-2009-4674—
admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to cha
23RIESGO
abrir ↗
Referência
CVE-2015-3897
CVE-2015-3897—
Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via
43RIESGO
abrir ↗
Referência
CVE-2010-3437
CVE-2010-3437—
Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2
23RIESGO
abrir ↗
Referência
CVE-2010-4980
CVE-2010-4980—
SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência
CVE-2010-4980
CVE-2010-4980—
SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitr
23RIESGO
abrir ↗
Referência✓ VexDay Proof
iyzi Forum 1.0b3 - Database Disclosure
CVE-2008-5901—webappsphp
iyzi Forum 1.0 beta 3 stores sensitive information under the web root with insufficient access control, which allows rem
23RIESGO
abrir ↗
Referência✓ VexDay Proof
GGCMS 1.1.0 RC1 - Remote Code Execution
CVE-2007-0804—webappsphp
Directory traversal vulnerability in admin/subpages.php in GGCMS 1.1.0 RC1 and earlier allows remote attackers to inject
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Garennes 0.6.1 - 'repertoire_config' Remote File Inclusion
CVE-2007-2298—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Garennes 0.6.1 and earlier allow remote attackers to execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
GoSamba 1.0.1 - 'INCLUDE_PATH' Multiple Remote File Inclusions
CVE-2007-5786—webappsphp
Multiple PHP remote file inclusion vulnerabilities in GoSamba 1.0.1 allow remote attackers to execute arbitrary PHP code
23RIESGO
abrir ↗
Referência✓ VexDay Proof
MODx CMS 0.9.6.2 - Remote File Inclusion / Cross-Site Scripting
CVE-2008-5938—webappsphp
PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier,
23RIESGO
abrir ↗
Referência
CVE-2012-3840
CVE-2012-3840—
Multiple cross-site scripting (XSS) vulnerabilities in index.php/users/form/user_id in MyClientBase 0.12 allow remote at
23RIESGO
abrir ↗
Referência
CVE-2022-23046
CVE-2022-23046—
PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a su
28RIESGO
abrir ↗
Referência
CVE-2010-2685
CVE-2010-2685—
siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attac
23RIESGO
abrir ↗
Referência
CVE-2010-2685
CVE-2010-2685—
siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attac
23RIESGO
abrir ↗
Referência✓ VexDay Proof
AJSquare Free Polling Script - 'DB' Multiple Vulnerabilities
CVE-2008-7045—webappsphp
AJ Square Free Polling Script (AJPoll) Database version allows remote attackers to bypass authentication and reset poll
23RIESGO
abrir ↗
Referência
CVE-2015-1467
CVE-2015-1467—
Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to exec
23RIESGO
abrir ↗
Referência
CVE-2015-6805
CVE-2015-6805—
Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticat
23RIESGO
abrir ↗
Referência
CVE-2017-6982
CVE-2017-6982—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. The issue involves the "Notifications"
23RIESGO
abrir ↗
Referência
CVE-2010-0983
CVE-2010-0983—
PHP remote file inclusion vulnerability in include/mail.inc.php in Rezervi 3.0.2 and earlier, when register_globals is e
23RIESGO
abrir ↗
Referência
CVE-2010-0983
CVE-2010-0983—
PHP remote file inclusion vulnerability in include/mail.inc.php in Rezervi 3.0.2 and earlier, when register_globals is e
23RIESGO
abrir ↗
Referência
CVE-2018-0821
CVE-2018-0821—
AppContainer in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows
23RIESGO
abrir ↗
Referência
CVE-2013-1359
CVE-2013-1359—
An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5
60RIESGO
abrir ↗
Referência
CVE-2017-9418
CVE-2017-9418—
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute ar
23RIESGO
abrir ↗
Referência
CVE-2010-2908
CVE-2010-2908—
SQL injection vulnerability in the Joomdle (com_joomdle) component 0.24 and earlier for Joomla! allows remote attackers
23RIESGO
abrir ↗
Referência
CVE-2010-2908
CVE-2010-2908—
SQL injection vulnerability in the Joomdle (com_joomdle) component 0.24 and earlier for Joomla! allows remote attackers
23RIESGO
abrir ↗
← anteriorpágina 650 / 754siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.