Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.939exploits catalogados
32.191CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.295VulnCheck XDB 8176Nuclei 4217Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4202 exploits
Nucleihigh
Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints
CVE-2023-32117CRITICAL
WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerability
63RIESGO
abrir ↗
Nucleimedium
EventON Lite < 2.1.2 - Arbitrary File Download
CVE-2023-3219—
EventON < 2.1.2 - Unauthenticated Post Access via IDOR
38RIESGO
abrir ↗
Nucleihigh
Ghost CMS < 5.42.1 - Path Traversal
CVE-2023-32235HIGH
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2
68RIESGO
abrir ↗
Nucleicritical
WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset
CVE-2023-32243CRITICAL
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
85RIESGO
abrir ↗
Nucleihigh
Openfire Administration Console - Authentication Bypass
CVE-2023-32315HIGHbajo ataque
Openfire administration console authentication bypass
100RIESGO
abrir ↗
Nucleicritical
Ivanti Avalanche - Remote Code Execution
CVE-2023-32563HIGH
An unauthenticated attacker could achieve the code execution through a RemoteControl server.
58RIESGO
abrir ↗
Nucleicritical
Subscribe to Category <= 2.7.4 - SQL Injection
CVE-2023-32590CRITICAL
WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection
63RIESGO
abrir ↗
Nucleicritical
MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
CVE-2023-3277CRITICAL
MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
43RIESGO
abrir ↗
Nucleicritical
Emby Server - Authentication Bypass
CVE-2023-33193CRITICAL
Emby Server Proxy Header Spoofing Vulnerability
43RIESGO
abrir ↗
Nucleicritical
Old Age Home Management System v1.0 - SQL Injection
CVE-2023-33338CRITICAL
Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.
43RIESGO
abrir ↗
Nucleimedium
BlogEngine CMS - Open Redirect
CVE-2023-33405MEDIUM
Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.
40RIESGO
abrir ↗
Nucleihigh
Faculty Evaluation System v1.0 - SQL Injection
CVE-2023-33439HIGH
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.
36RIESGO
abrir ↗
Nucleihigh
Faculty Evaluation System v1.0 - Remote Code Execution
CVE-2023-33440HIGH
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_u
61RIESGO
abrir ↗
Nucleimedium
LMS by Masteriyo < 1.6.8 - Information Exposure
CVE-2023-3345—
LMS by Masteriyo < 1.6.8 - Information Exposure
18RIESGO
abrir ↗
Nucleihigh
Jeecg P3 Biz Chat - Local File Inclusion
CVE-2023-33510HIGH
Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.
36RIESGO
abrir ↗
Nucleihigh
Dolibarr Unauthenticated Contacts Database Theft
CVE-2023-33568—
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's
23RIESGO
abrir ↗
Nucleihigh
H3C Magic R300-2100M - Remote Code Execution
CVE-2023-33629HIGH
H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at
36RIESGO
abrir ↗
Nucleicritical
Chamilo LMS <= v1.11.20 Unauthenticated Command Injection
CVE-2023-3368CRITICAL
Chamilo LMS Unauthenticated Command Injection
55RIESGO
abrir ↗
Nucleicritical
WAVLINK WN579X3 - Remote Command Execution
CVE-2023-3380MEDIUM
Wavlink WN579X3 Ping Test adm.cgi injection
28RIESGO
abrir ↗
Nucleicritical
FUXA - Unauthenticated Remote Code Execution
CVE-2023-33831—
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute
43RIESGO
abrir ↗
Nucleihigh
Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting
CVE-2023-3388HIGH
Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting
58RIESGO
abrir ↗
Nucleimedium
OpenProject < 12.5.4 - Project Identifiers Exposure
CVE-2023-33960HIGH
OpenProject vulnerable to project identifier information leakage through robots.txt
36RIESGO
abrir ↗
Nucleimedium
Uncanny Toolkit for LearnDash - Open Redirection
CVE-2023-34020MEDIUM
WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Open Redirection vulnerability
28RIESGO
abrir ↗
Nucleicritical
VMware vCenter Server - Out-of-Bounds Write
CVE-2023-34048CRITICALbajo ataque
VMware vCenter Server Out-of-Bounds Write Vulnerability
95RIESGO
abrir ↗
Nucleihigh
Vite Dev Server - Information Exposure
CVE-2023-34092HIGH
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
36RIESGO
abrir ↗
Nucleihigh
SRS - Command Injection
CVE-2023-34105HIGH
SRS has command injection vulnerability in demonstration api-server for HTTP callback.
36RIESGO
abrir ↗
Nucleicritical
SonicWall GMS and Analytics Web Services - Shell Injection
CVE-2023-34124CRITICAL
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticatio
75RIESGO
abrir ↗
Nucleihigh
SonicWall GMS and Analytics - SQL Injection
CVE-2023-34133HIGH
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and
58RIESGO
abrir ↗
Nucleicritical
Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting
CVE-2023-34192CRITICALbajo ataque
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary co
95RIESGO
abrir ↗
Nucleimedium
Kyocera TASKalfa printer - Path Traversal
CVE-2023-34259MEDIUM
Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read ar
40RIESGO
abrir ↗
← anteriorpágina 109 / 141siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.