Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.794exploits catalogados
36.057CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
4350 exploits
Nucleimedium
Lazy Blocks <= 3.8.2 - Cross-Site Scripting
CVE-2024-12878HIGH
Custom Block Builder – Lazy Blocks < 3.8.3 - Reflected XSS
36RIESGO
abrir ↗
Nucleicritical
DrayTek Vigor - Command Injection
CVE-2024-12987MEDIUMbajo ataque
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
100RIESGO
abrir ↗
Nucleihigh
Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting
CVE-2024-13055HIGH
Dyn Business Panel <= 1.0.0 - Reflected XSS
36RIESGO
abrir ↗
Nucleihigh
WP Triggers Lite - Cross-Site Scripting
CVE-2024-13094HIGH
WP Triggers Lite <= 2.5.3 - Reflected XSS
36RIESGO
abrir ↗
Nucleimedium
WP Finance Plugin <= 1.3.6 - Cross-Site Scripting
CVE-2024-13097MEDIUM
WP Finance <= 1.3.6 - Reflected XSS
28RIESGO
abrir ↗
Nucleimedium
WordPress Email Newsletter - Reflected XSS
CVE-2024-13098MEDIUM
WP Email Newsletter <= 1.1 - Reflected XSS
28RIESGO
abrir ↗
Nucleimedium
Widget4Call WordPress - Cross-Site Scripting
CVE-2024-13099MEDIUM
Widget4call <= 1.0.7 - Reflected XSS
28RIESGO
abrir ↗
Nucleicritical
St. Joe ERP system - SQL Injection
CVE-2024-13979CRITICAL
St. Joe ERP System SingleRowQueryConverter SQL Injection
63RIESGO
abrir ↗
Nucleicritical
Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle
CVE-2024-13985CRITICAL
Dahua EIMS capture_handle.action RCE
68RIESGO
abrir ↗
Nucleimedium
Studiocart <= 2.9.0 - Cross-Site Scripting
CVE-2024-14015HIGH
Studiocart <= 2.9.0 - Reflected XSS
36RIESGO
abrir ↗
Nucleihigh
Mlflow < 2.9.2 - Path Traversal
CVE-2024-1483HIGH
Path Traversal Vulnerability in mlflow/mlflow
36RIESGO
abrir ↗
Nucleicritical
MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection
CVE-2024-1512CRITICAL
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection
85RIESGO
abrir ↗
Nucleihigh
Gradio 4.3-4.12 - Local File Read
CVE-2024-1561HIGH
Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio
56RIESGO
abrir ↗
Nucleicritical
NotificationX <= 2.8.2 - SQL Injection
CVE-2024-1698CRITICAL
NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection
85RIESGO
abrir ↗
Nucleihigh
ConnectWise ScreenConnect <= 23.9.7 - Path Traversal
CVE-2024-1708HIGHbajo ataqueransomware
Improper limitation of a pathname to a restricted directory (“path traversal”)
100RIESGO
abrir ↗
Nucleicritical
ConnectWise ScreenConnect 23.9.7 - Authentication Bypass
CVE-2024-1709CRITICALbajo ataqueransomware
Authentication bypass using an alternate path or channel
100RIESGO
abrir ↗
Nucleihigh
Gradio > 4.19.1 UploadButton - Path Traversal
CVE-2024-1728HIGH
Local File Inclusion in gradio-app/gradio
58RIESGO
abrir ↗
Nucleihigh
Tutor LMS <= 2.1.10 - SQL Injection
CVE-2024-1751HIGH
Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
36RIESGO
abrir ↗
Nucleimedium
Cisco Finesse - Server-Side Request Forgery (SSRF)
CVE-2024-20404HIGH
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker t
61RIESGO
abrir ↗
Nucleicritical
Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover
CVE-2024-20419CRITICAL
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauth
85RIESGO
abrir ↗
Nucleicritical
Hardcoded Admin Credentials For Cisco Smart Licensing Utility API
CVE-2024-20439CRITICALbajo ataque
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an a
95RIESGO
abrir ↗
Nucleihigh
Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials
CVE-2024-20440HIGH
A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive inf
48RIESGO
abrir ↗
Nucleihigh
Artica Proxy - Unauthenticated LFI
CVE-2024-2053HIGH
Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability
68RIESGO
abrir ↗
Nucleihigh
Adobe ColdFusion - Arbitrary File Read
CVE-2024-20767HIGHbajo ataque
ColdFusion | Improper Access Control (CWE-284)
100RIESGO
abrir ↗
Nucleihigh
Oracle Retail Xstore Suite - Pre-authenticated Path Traversal
CVE-2024-21136HIGH
Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported
36RIESGO
abrir ↗
Nucleimedium
Dash Framework - Cross-site Scripting
CVE-2024-21485MEDIUM
Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; v
28RIESGO
abrir ↗
Nucleihigh
MobSF - Path Traversal
CVE-2024-21633HIGH
Arbitrary file write on Decoding
36RIESGO
abrir ↗
Nucleimedium
Flarum < 1.8.5 - Open Redirect
CVE-2024-21641MEDIUM
Flarum's Logout Route allows open redirects
28RIESGO
abrir ↗
Nucleihigh
pyLoad Flask Config - Access Control
CVE-2024-21644HIGH
pyLoad unauthenticated flask configuration leakage
48RIESGO
abrir ↗
Nucleimedium
pyload - Log Injection
CVE-2024-21645MEDIUM
pyLoad Log Injection
33RIESGO
abrir ↗
← anteriorpágina 11 / 145siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.