Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
4478 exploits
Nucleicritical
Adobe ColdFusion WDDX Deserialization Gadgets
CVE-2023-44353CRITICAL
ColdFusion WDDX Deserialization Gadgets
65RIESGO
abrir ↗
Nucleimedium
Piwigo - Cross-Site Scripting
CVE-2023-44393CRITICAL
Piwigo Reflected XSS vulnerability
43RIESGO
abrir ↗
Nucleicritical
JeecgBoot JimuReport - Template injection
CVE-2023-4450MEDIUM
jeecgboot JimuReport Template injection
53RIESGO
abrir ↗
Nucleimedium
Cockpit - Cross-Site Scripting
CVE-2023-4451MEDIUM
Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit
28RIESGO
abrir ↗
Nucleimedium
mooSocial v.3.1.8 - Cross-Site Scripting
CVE-2023-44812—
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a c
18RIESGO
abrir ↗
Nucleimedium
mooSocial v.3.1.8 - Cross-Site Scripting
CVE-2023-44813—
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a c
18RIESGO
abrir ↗
Nucleihigh
WordPress Job Portal < 2.0.6 - SQL Injection
CVE-2023-4490CRITICAL
WP Job Portal < 2.0.6 - Unauthenticated SQLi
63RIESGO
abrir ↗
Nucleimedium
WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure
CVE-2023-44982MEDIUM
WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure
28RIESGO
abrir ↗
Nucleimedium
QNAP Music Station < 5.4.0 - Authentication Bypass
CVE-2023-45038MEDIUM
Music Station
28RIESGO
abrir ↗
Nucleimedium
XWiki < 14.10.14 - Cross-Site Scripting
CVE-2023-45136CRITICAL
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
43RIESGO
abrir ↗
Nucleicritical
WordPress File Manager <= 7.2.1 - Directory Traversal
CVE-2023-6825CRITICAL
File Manager And File Manager Pro (Multiple Versions) - Directory Traversal
43RIESGO
abrir ↗
Nucleihigh
mlflow - Path Traversal
CVE-2023-6831HIGH
Path Traversal: '\..\filename' in mlflow/mlflow
36RIESGO
abrir ↗
Nucleicritical
WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass
CVE-2023-6875CRITICAL
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
85RIESGO
abrir ↗
Nucleicritical
Hikvision IP ping.php - Command Execution
CVE-2023-6895MEDIUM
Hikvision Intercom Broadcasting System ping.php os command injection
70RIESGO
abrir ↗
Nucleihigh
Mlflow <2.9.2 - Path Traversal
CVE-2023-6909HIGH
Path Traversal: '\..\filename' in mlflow/mlflow
58RIESGO
abrir ↗
Nucleicritical
Better Search Replace < 1.4.5 - PHP Object Injection
CVE-2023-6933HIGH
Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection
68RIESGO
abrir ↗
Nucleimedium
WP Recipe Maker <= 9.1.0 - Reflected XSS via Referer Header
CVE-2023-6970MEDIUM
WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer
28RIESGO
abrir ↗
Nucleihigh
Mlflow <2.8.0 - Local File Inclusion
CVE-2023-6977CRITICAL
Path Traversal: '\..\filename'
43RIESGO
abrir ↗
Nucleicritical
Shield Security WP Plugin <= 18.5.9 - Local File Inclusion
CVE-2023-6989CRITICAL
Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion
55RIESGO
abrir ↗
Nucleihigh
GitLab - Account Takeover via Password Reset
CVE-2023-7028CRITICALbajo ataque
Weak Password Recovery Mechanism for Forgotten Password in GitLab
100RIESGO
abrir ↗
Nucleimedium
WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection
CVE-2023-7116MEDIUM
WeiYe-Jing datax-web HTTP POST Request killJob os command injection
28RIESGO
abrir ↗
Nucleihigh
WordPress BackWPup < 4.0.4 - Backup File Disclosure
CVE-2023-7164HIGH
BackWPup < 4.0.4 - Unauthenticated Backup Download
36RIESGO
abrir ↗
Nucleihigh
JetBackup <= 2.0.9.7 - Sensitive Information Exposure via Directory Listing
CVE-2023-7165HIGH
JetBackup < 2.0.9.9 - Directory Listing Exposing Backups
36RIESGO
abrir ↗
Nucleimedium
System Dashboard < 2.8.10 - Cross-Site Scripting
CVE-2023-7246MEDIUM
System Dashboard < 2.8.10 - XSS via Header Injection
28RIESGO
abrir ↗
Nucleihigh
Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read
CVE-2023-7327HIGH
Ozeki SMS Gateway <= 10.3.208 Unauthenticated Arbitrary File Read
36RIESGO
abrir ↗
Nucleicritical
JS Help Desk <= 2.8.2 - SQL Injection
CVE-2023-7337HIGH
JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie
36RIESGO
abrir ↗
Nucleicritical
PAN-OS Management Web Interface - Authentication Bypass
CVE-2024-0012CRITICALbajo ataqueransomware
PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
100RIESGO
abrir ↗
Nucleicritical
SpiderFlow Crawler Platform - Remote Code Execution
CVE-2024-0195MEDIUM
spider-flow FunctionController.java FunctionService.saveFunction code injection
33RIESGO
abrir ↗
Nucleicritical
Github Enterprise - Remote Code Execution
CVE-2024-0200HIGH
Unsafe Reflection in Github Enterprise Server leading to Command Injection
58RIESGO
abrir ↗
Nucleicritical
Fortra GoAnywhere MFT - Authentication Bypass
CVE-2024-0204CRITICAL
Authentication Bypass in GoAnywhere MFT
85RIESGO
abrir ↗
← anteriorpágina 104 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.