Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.324exploits catalogados
36.054CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.721GitHub PoC 14.477VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.721 exploits
Referência✓ VexDay Proof
DataTrac Activity Console - Denial of Service
CVE-2005-1667—doswindows
DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request.
23RIESGO
abrir ↗
Referência
CVE-2011-5130
CVE-2011-5130—
dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers t
50RIESGO
abrir ↗
Referência
CVE-2020-11108
CVE-2020-11108—
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abus
60RIESGO
abrir ↗
Referência
CVE-2020-11108
CVE-2020-11108—
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abus
60RIESGO
abrir ↗
Referência
CVE-2026-16228
CVE-2026-16228MEDIUM
SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2014-8739
CVE-2014-8739—
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery
60RIESGO
abrir ↗
Referência
CVE-2017-1274
CVE-2017-1274—
IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated
23RIESGO
abrir ↗
Referência
CVE-2020-37168
CVE-2020-37168CRITICAL
Ecommerce Systempay 1.0 Production Key Brute Force
48RIESGO
abrir ↗
Referência
CVE-2026-9810
CVE-2026-9810CRITICAL
AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth
48RIESGO
abrir ↗
Referência
CVE-2017-12786
CVE-2017-12786—
Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW40
28RIESGO
abrir ↗
Referência✓ VexDay Proof
ActiveBuyandSell 6.2 - 'buyersend.asp?catid' SQL Injection
CVE-2005-2062—webappsasp
Multiple SQL injection vulnerabilities in ActiveBuyAndSell 6.2 allow remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência
CVE-2014-9004
CVE-2014-9004—
Cross-site scripting (XSS) vulnerability in vldPersonals before 2.7.1 allows remote attackers to inject arbitrary web sc
23RIESGO
abrir ↗
Referência
CVE-2026-59258
CVE-2026-59258HIGH
immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser
41RIESGO
abrir ↗
Referência
CVE-2021-47929
CVE-2021-47929MEDIUM
WordPress Plugin Filterable Portfolio Gallery 1.0 Stored XSS
33RIESGO
abrir ↗
Referência
CVE-2021-47928
CVE-2021-47928HIGH
Opencart TMD Vendor System 3.x Blind SQL Injection via product route
41RIESGO
abrir ↗
Referência
CVE-2021-47923
CVE-2021-47923CRITICAL
OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie
48RIESGO
abrir ↗
Referência
CVE-2011-5204
CVE-2011-5204—
Akiva WebBoard 8.x stores passwords in plaintext, which allows local users to obtain sensitive information by reading fr
23RIESGO
abrir ↗
Referência
CVE-2005-2428
CVE-2005-2428—
Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hid
60RIESGO
abrir ↗
Referência
CVE-2014-9095
CVE-2014-9095—
Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência
CVE-2026-14642
CVE-2026-14642MEDIUM
SourceCodester Class and Exam Timetabling System edit_class2.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14641
CVE-2026-14641MEDIUM
SourceCodester Class and Exam Timetabling System edit_course.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14640
CVE-2026-14640MEDIUM
CodeAstro Apartment Visitor Management System Login index.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14639
CVE-2026-14639MEDIUM
CodeAstro Ecommerce Website my_account.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14633
CVE-2026-14633MEDIUM
kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting
33RIESGO
abrir ↗
Referência
CVE-2026-14607
CVE-2026-14607MEDIUM
RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption
33RIESGO
abrir ↗
Referência
CVE-2014-9097
CVE-2014-9097—
Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly
23RIESGO
abrir ↗
Referência
CVE-2026-8207
CVE-2026-8207HIGH
Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/gr
41RIESGO
abrir ↗
Referência
Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection
CVE-2020-15255HIGHwebappsphp
CSV injection in Anuko Time Tracker
41RIESGO
abrir ↗
Referência
CVE-2017-20265
CVE-2017-20265HIGH
Joomla! Component Flip Wall 8.0 SQL Injection
41RIESGO
abrir ↗
Referência
CVE-2011-5283
CVE-2011-5283—
Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Expre
23RIESGO
abrir ↗
← anteriorpágina 710 / 758siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.