Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
79.107exploits catalogados
36.322CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8846Nuclei 4361Metasploit 3490✓ solo verificadosrecientespopularesriesgo
19.066 exploits
Exploit-DB✓ VexDay Proof
Granding MA300 - Weak Pin Encryption Brute Force
Grand MA 300 allows a brute-force attack on the PIN.
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
VTLS Virtua InfoStation.cgi - SQL Injection
Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua bef
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ManageEngine Password Manager - MetadataServlet.dat SQL Injection (Metasploit)
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ArticleFR - 'id' SQL Injection
Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execut
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ManageEngine Password Manager Pro / ManageEngine IT360 - SQL Injection
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manag
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WP Content Source Control - 'download.php' Directory Traversal
Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Sour
43RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Gitlab-shell - Code Execution (Metasploit)
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox - toString console.time Privileged JavaScript Injection (Metasploit)
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbi
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/s
38RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)
Blue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtu
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox Guest Additions 4.3.10r93012 - 'VBoxGuest.sys' Local Privilege Escalation (Metasploit)
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.2
38RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin GB Gallery Slideshow - '/wp-admin/admin-ajax.php' SQL Injection
SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administ
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Symantec Endpoint Protection 11.x/12.x - Kernel Pool Overflow / Local Privilege Escalation
Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b,
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin FB Gorilla - 'game_play.php' SQL Injection
SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute a
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus al
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbi
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WhyDoWork AdSense - 'options-general.php' Cross-Site Request Forgery (Option Manipulation)
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Lead Octopus Power - 'id' SQL Injection
SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DirPHP 1.0 - Local File Inclusion
Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation (Metasploit)
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Ubiquiti Networks UniFi Video Default - 'crossdomain.xml' Security Bypass
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVisi
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Ilya Birman E2 - '/@actions/comment-process' SQL Injection
SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the no
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities
systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote auth
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities
prodtest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote aut
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
OL-Commerce - '/OL-Commerce/affiliate_signup.php?a_country' SQL Injection
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Fonality trixbox - 'index.php' Remote Code Execution
maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacha
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.