Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.832 exploits
Referência
CVE-2026-14777
CVE-2026-14777MEDIUM
SourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-14776
CVE-2026-14776MEDIUM
SourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-14775
CVE-2026-14775MEDIUM
SourceCodester Onlne Examination & Learning Management System process_lesson.php unrestricted upload
33RIESGO
abrir ↗
Referência
CVE-2026-14774
CVE-2026-14774MEDIUM
itsourcecode Hospital Management System paymentdischarge.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14773
CVE-2026-14773MEDIUM
itsourcecode Hospital Management System payment.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-14772
CVE-2026-14772MEDIUM
SourceCodester Class and Exam Timetabling System edit_course1.php sql injection
33RIESGO
abrir ↗
Referência✓ VexDay Proof
ResearchGuide 0.5 - 'id' SQL Injection
CVE-2008-2964—webappsphp
SQL injection vulnerability in guide.php in ResearchGuide 0.5 allows remote attackers to execute arbitrary SQL commands
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Softbiz Ad Management plus Script 1 - SQL Injection
CVE-2007-5998—webappsphp
SQL injection vulnerability in ads.php in Softbiz Ad Management plus Script 1 allows remote authenticated users to execu
23RIESGO
abrir ↗
Referência✓ VexDay Proof
IceBB 1.0-rc6 - Remote Database Authentication Details
CVE-2007-6083—webappsphp
SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
CVE-2021-30034
CVE-2021-30034—
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Symptons field on patients/register-report.php.
23RIESGO
abrir ↗
Referência
CVE-2026-34111
CVE-2026-34111CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php
48RIESGO
abrir ↗
Referência
CVE-2026-34105
CVE-2026-34105HIGH
Guardian Language-System SQL Injection via id Parameter in translate_text.php
41RIESGO
abrir ↗
Referência
CVE-2026-34104
CVE-2026-34104HIGH
Guardian Language-System SQL Injection via name Parameter in designer.php
41RIESGO
abrir ↗
Referência
CVE-2026-11887
CVE-2026-11887MEDIUM
Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass
33RIESGO
abrir ↗
Referência
CVE-2026-11570
CVE-2026-11570MEDIUM
User Submitted Posts < 20260608 - Unauthenticated Stored XSS via Author Name
33RIESGO
abrir ↗
Referência
CVE-2026-58448
CVE-2026-58448HIGH
yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API
41RIESGO
abrir ↗
Referência
CVE-2026-58447
CVE-2026-58447HIGH
Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check
41RIESGO
abrir ↗
Referência
CVE-2026-58446
CVE-2026-58446MEDIUM
Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint
33RIESGO
abrir ↗
Referência
CVE-2026-6324
CVE-2026-6324MEDIUM
Libsoup: libsoup: http request smuggling via unsigned to signed conversion error
33RIESGO
abrir ↗
Referência
CVE-2018-11776
CVE-2018-11776HIGHbajo ataque
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗
Referência
CVE-2018-11776
CVE-2018-11776HIGHbajo ataque
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗
Referência✓ VexDay Proof
Plogger 3.0 - SQL Injection
CVE-2008-3563—webappsphp
Multiple SQL injection vulnerabilities in Plogger 3.0 and earlier allow remote attackers to execute arbitrary SQL comman
23RIESGO
abrir ↗
Referência
CVE-2026-9606
CVE-2026-9606MEDIUM
itsourcecode Courier Management System manage_user.php sql injection
33RIESGO
abrir ↗
Referência
CVE-2026-9605
CVE-2026-9605MEDIUM
GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow
33RIESGO
abrir ↗
Referência✓ VexDay Proof
IP Reg 0.4 - Multiple SQL Injections
CVE-2008-4606—webappsphp
Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Referência
Joomla! Component JEXTN Membership 3.1.0 - 'usr_plan' SQL Injection
CVE-2018-6577—webappsphp
SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&ta
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Eurologon CMS - 'files.php' Arbitrary File Download
CVE-2007-6185—webappsphp
Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files vi
23RIESGO
abrir ↗
Referência
Joomla! Component JEXTN Reverse Auction 3.1.0 - SQL Injection
CVE-2018-6579—webappsphp
SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.
23RIESGO
abrir ↗
Referência
CVE-2019-0211
CVE-2019-0211HIGHbajo ataque
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privilege
83RIESGO
abrir ↗
Referência
CVE-2026-73033
CVE-2026-73033HIGH
Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php
41RIESGO
abrir ↗
← anteriorpágina 739 / 762siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.