Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.794exploits catalogados
36.057CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.721 exploits
Referência✓ VexDay Proof
BoatScripts Classifieds - 'type' SQL Injection
CVE-2008-2846—webappsphp
SQL injection vulnerability in index.php in BoatScripts Classifieds allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência
CVE-2018-1122
CVE-2018-1122HIGH
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset
41RIESGO
abrir ↗
Referência✓ VexDay Proof
project alumni 1.0.9 - Cross-Site Scripting / SQL Injection
CVE-2007-6126—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject
23RIESGO
abrir ↗
Referência✓ VexDay Proof
WorkingOnWeb 2.0.1400 - 'events.php' SQL Injection
CVE-2007-6128—webappsphp
SQL injection vulnerability in events.php in WorkingOnWeb 2.0.1400 allows remote attackers to execute arbitrary SQL comm
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Content Injector 1.52 - 'index.php?cat' SQL Injection
CVE-2007-6137—webappsphp
SQL injection vulnerability in news.php in Content Injector 1.52 allows remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2026-11998
CVE-2026-11998HIGH
AngularJS XSS via SCE resource URL sanitization bypass
41RIESGO
abrir ↗
Referência
CVE-2026-11998
CVE-2026-11998HIGH
AngularJS XSS via SCE resource URL sanitization bypass
41RIESGO
abrir ↗
Referência
CVE-2026-50128
CVE-2026-50128MEDIUM
Mastodon: Spoofing of attribution domains
33RIESGO
abrir ↗
Referência
CVE-2026-8379
CVE-2026-8379HIGH
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download
41RIESGO
abrir ↗
Referência
CVE-2026-7842
CVE-2026-7842MEDIUM
Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter
33RIESGO
abrir ↗
Referência
CVE-2026-12823
CVE-2026-12823MEDIUM
Browserbase Skills Autobrowse Trace Artifact default permission
33RIESGO
abrir ↗
Referência
CVE-2026-12814
CVE-2026-12814MEDIUM
Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-12810
CVE-2026-12810MEDIUM
Edimax BR-6478AC V2 POST Request mp command injection
33RIESGO
abrir ↗
Referência
CVE-2018-11776
CVE-2018-11776HIGHbajo ataque
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗
Referência
CVE-2018-11776
CVE-2018-11776HIGHbajo ataque
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Plogger 3.0 - SQL Injection
CVE-2008-3563—webappsphp
Multiple SQL injection vulnerabilities in Plogger 3.0 and earlier allow remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2026-6324
CVE-2026-6324MEDIUM
Libsoup: libsoup: http request smuggling via unsigned to signed conversion error
33RIESGO
abrir ↗
Referência
CVE-2026-9606
CVE-2026-9606MEDIUM
itsourcecode Courier Management System manage_user.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-9605
CVE-2026-9605MEDIUM
GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow
33RIESGO
abrir ↗
Referência
CVE-2026-9512
CVE-2026-9512MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-9511
CVE-2026-9511MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection
33RIESGO
abrir ↗
Referência
CVE-2026-9498
CVE-2026-9498MEDIUM
Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
33RIESGO
abrir ↗
Referência
CVE-2018-5981
CVE-2018-5981—
SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.
23RIESGO
abrir ↗
Referência
CVE-2018-5982
CVE-2018-5982—
SQL Injection exists in the Advertisement Board 3.1.0 component for Joomla! via a task=show_rss_categories&catname= requ
23RIESGO
abrir ↗
Referência
CVE-2026-44195
CVE-2026-44195MEDIUM
OPNsense: Authentication lockout bypass
33RIESGO
abrir ↗
Referência
CVE-2026-73033
CVE-2026-73033HIGH
Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php
41RIESGO
abrir ↗
Referência✓ VexDay Proof
IP Reg 0.4 - Multiple SQL Injections
CVE-2008-4606—webappsphp
Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2026-19089
CVE-2026-19089CRITICAL
Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
48RIESGO
abrir ↗
Referência
Joomla! Component JEXTN Membership 3.1.0 - 'usr_plan' SQL Injection
CVE-2018-6577—webappsphp
SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&ta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Eurologon CMS - 'files.php' Arbitrary File Download
CVE-2007-6185—webappsphp
Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files vi
23RIESGO
abrir ↗
← anteriorpágina 735 / 758siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.