Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
22.832 exploits
Referência
CVE-2026-19376
CVE-2026-19376MEDIUM
Uasoft Badaso File API api.php class permission
33RIESGO
abrir ↗
Referência
CVE-2026-19375
CVE-2026-19375MEDIUM
dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery
33RIESGO
abrir ↗
Referência
CVE-2026-19353
CVE-2026-19353LOW
DedeCMS Installation Wizard index.php _4_Setup file inclusion
28RIESGO
abrir ↗
Referência✓ VexDay Proof
Limbo CMS 1.0.4.2 - 'sql.php' Remote File Inclusion
CVE-2006-2142—webappsphp
PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Aardvark Topsites PHP 4.2.2 - 'lostpw.php' Remote File Inclusion
CVE-2006-2149—webappsphp
PHP remote file inclusion vulnerability in sources/lostpw.php in Aardvark Topsites PHP 4.2.2 and earlier, when register_
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Woltlab Burning Board 2.3.5 - 'links.php' SQL Injection
CVE-2006-2569—webappsphp
SQL injection vulnerability in links.php in 4R Linklist 1.0 RC2 and earlier, a module for Woltlab Burning Board, allows
23RIESGO
abrir ↗
Referência✓ VexDay Proof
CaLogic Calendars 1.2.2 - 'CLPath' Remote File Inclusion
CVE-2006-2570—webappsphp
PHP remote file inclusion vulnerability in CaLogic Calendars 1.2.2 allows remote attackers to execute arbitrary PHP code
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Sugar Suite Open Source 4.2 - 'OptimisticLock' Command Execution
CVE-2006-2460—webappsphp
Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variable
28RIESGO
abrir ↗
Referência
CVE-2006-2465
CVE-2006-2465—
Buffer overflow in MP3Info 0.8.4 allows attackers to execute arbitrary code via a long command line argument. NOTE: if
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpMyDirectory 10.4.4 - 'ROOT_PATH' Remote File Inclusion
CVE-2006-2521—webappsphp
PHP remote file inclusion vulnerability in cron.php in phpMyDirectory 10.4.4 and earlier allows remote attackers to exec
23RIESGO
abrir ↗
Referência✓ VexDay Proof
phpListPro 2.0.1 - 'Language' Remote Code Execution
CVE-2006-2523—webappsphp
PHP remote file inclusion vulnerability in config.php in phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
TR Newsportal 0.36tr1 - 'poll.php' Remote File Inclusion
CVE-2006-2557—webappsphp
PHP remote file inclusion vulnerability in extras/poll/poll.php in Florian Amrhein NewsPortal before 0.37, and TR Newspo
28RIESGO
abrir ↗
Referência✓ VexDay Proof
open-medium.CMS 0.25 - '404.php' Remote File Inclusion
CVE-2006-2683—webappsphp
PHP remote file inclusion vulnerability in 404.php in open-medium.CMS 0.25 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Fastpublish CMS 1.6.9 - config[fsBase] Remote File Inclusion
CVE-2006-2726—webappsphp
PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files vi
28RIESGO
abrir ↗
Referência✓ VexDay Proof
metajour 2.1 - 'system_path' Remote File Inclusion
CVE-2006-2768—webappsphp
PHP remote file inclusion vulnerability in METAjour 2.1, when register_globals is enabled, allows remote attackers to ex
23RIESGO
abrir ↗
Referência✓ VexDay Proof
gxine 0.5.6 - HTTP Plugin Remote Buffer Overflow (PoC)
CVE-2006-2802—doslinux
Buffer overflow in the HTTP Plugin (xineplug_inp_http.so) for xine-lib 1.1.1 allows remote attackers to cause a denial o
28RIESGO
abrir ↗
Referência✓ VexDay Proof
gnopaste 0.5.3 - 'common.php' Remote File Inclusion
CVE-2006-2834—webappsphp
PHP remote file inclusion vulnerability in includes/common.php in gnopaste 0.5.3 and earlier allows remote attackers to
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Redaxo 3.2 - 'INCLUDE_PATH' Remote File Inclusion
CVE-2006-2845—webappsphp
PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code vi
23RIESGO
abrir ↗
Referência✓ VexDay Proof
aspWebLinks 2.0 - SQL Injection / Admin Pass Change
CVE-2006-2848—webappsasp
links.asp in aspWebLinks 2.0 allows remote attackers to change the administrative password, possibly via a direct reques
23RIESGO
abrir ↗
Referência
CVE-2026-43891
CVE-2026-43891HIGH
changedetection.io: Arbitrary Local File Read via crafted backup restore
41RIESGO
abrir ↗
Referência
CVE-2021-47936
CVE-2021-47936CRITICAL
OpenCATS 0.9.4 Remote Code Execution via Resume Upload
48RIESGO
abrir ↗
Referência
CVE-2021-47927
CVE-2021-47927MEDIUM
WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_name
33RIESGO
abrir ↗
Referência
CVE-2026-8270
CVE-2026-8270MEDIUM
Open5GS SMF ogs_nas_parse_qos_rules denial of service
33RIESGO
abrir ↗
Referência✓ VexDay Proof
PAPOO 3_RC3 - SQL Injection / Admin Credentials Disclosure
CVE-2006-3572—webappsphp
SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência
CVE-2018-17173
CVE-2018-17173—
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getT
50RIESGO
abrir ↗
Referência✓ VexDay Proof
Winlpd 1.2 Build 1076 - Remote Buffer Overflow
CVE-2006-3670—remotewindows
Stack-based buffer overflow in Winlpd 1.26 allows remote attackers to execute arbitrary code via a long string in a requ
23RIESGO
abrir ↗
Referência
CVE-2026-14831
CVE-2026-14831MEDIUM
Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass
33RIESGO
abrir ↗
Referência
CVE-2026-12901
CVE-2026-12901MEDIUM
GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification
33RIESGO
abrir ↗
Referência
CVE-2026-12501
CVE-2026-12501MEDIUM
WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification
33RIESGO
abrir ↗
Referência
CVE-2026-15152
CVE-2026-15152MEDIUM
WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass
33RIESGO
abrir ↗
← anteriorpágina 743 / 762siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.