Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.150exploits catalogados

39.601CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9680Nuclei 4488Metasploit 3525✓ solo verificadosrecientes populares riesgo

4488 exploits

Nucleimedium

WordPress Realteo <=1.2.3 - Cross-Site Scripting

CVE-2021-24237—

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress Pie Register <3.7.0.1 - Cross-Site Scripting

CVE-2021-24239—

Pie Register < 3.7.0.1 - Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress Stop Spammers <2021.9 - Cross-Site Scripting

CVE-2021-24245—

Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)

38RIESGO

abrir ↗

Nucleimedium

WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting

CVE-2021-24274—

Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)

43RIESGO

abrir ↗

Nucleimedium

The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting

CVE-2021-25008—

Code Snippets < 2.14.3 - Reflected Cross-Site Scripting

18RIESGO

abrir ↗

Nucleimedium

Chaty < 2.8.2 - Cross-Site Scripting

CVE-2021-25016—

Chaty < 2.8.3 - Reflected Cross-Site Scripting

18RIESGO

abrir ↗

Nucleimedium

WordPress Event Tickets < 5.2.2 - Open Redirect

CVE-2021-25028—

Event Tickets < 5.2.2 - Open Redirect

18RIESGO

abrir ↗

Nucleicritical

PublishPress Capabilities < 2.3.1 - Missing Authorization

CVE-2021-25032—

PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise

38RIESGO

abrir ↗

Nucleimedium

Noptin < 1.6.5 - Open Redirect

CVE-2021-25033—

Noptin < 1.6.5 - Open Redirect

18RIESGO

abrir ↗

Nucleihigh

WordPress Button Generator <2.3.3 - Remote File Inclusion

CVE-2021-25052—

Button Generator < 2.3.3 - RFI leading to RCE via CSRF

18RIESGO

abrir ↗

Nucleimedium

WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting

CVE-2021-25055—

FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting

CVE-2021-25063—

Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting

CVE-2021-25065—

Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

Landing Page Builder < 1.4.9.6 - Cross-Site Scripting

CVE-2021-25067—

Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect

CVE-2021-25074—

WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect

18RIESGO

abrir ↗

Nucleilow

WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting

CVE-2021-25075—

Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS

18RIESGO

abrir ↗

Nucleimedium

Affiliates Manager < 2.9.0 - Cross Site Scripting

CVE-2021-25078—

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

18RIESGO

abrir ↗

Nucleimedium

Contact Form Entries < 1.2.4 - Cross-Site Scripting

CVE-2021-25079—

Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting

18RIESGO

abrir ↗

Nucleicritical

WordPress Popup Builder < 4.0.7 - Remote Code Execution

CVE-2021-25082—

Popup Builder < 4.0.7 - LFI to RCE

18RIESGO

abrir ↗

Nucleimedium

WOOF WordPress plugin - Cross-Site Scripting

CVE-2021-25085—

WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site Scripting

18RIESGO

abrir ↗

Nucleihigh

Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution

CVE-2021-25094—

Tatsu < 3.3.12 - Unauthenticated RCE

60RIESGO

abrir ↗

Nucleimedium

WordPress GiveWP <2.17.3 - Cross-Site Scripting

CVE-2021-25099—

Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting

18RIESGO

abrir ↗

Nucleimedium

WordPress Ocean Extra <1.9.5 - Cross-Site Scripting

CVE-2021-25104—

Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting

18RIESGO

abrir ↗

Nucleimedium

WordPress English Admin <1.5.2 - Open Redirect

CVE-2021-25111—

English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect

18RIESGO

abrir ↗

Nucleimedium

WordPress WHMCS Bridge <6.4b - Cross-Site Scripting

CVE-2021-25112—

WHMCS Bridge < 6.4b - Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleicritical

WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection

CVE-2021-25114—

Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection

40RIESGO

abrir ↗

Nucleimedium

Yoast SEO 16.7-17.2 - Information Disclosure

CVE-2021-25118—

Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure

18RIESGO

abrir ↗

Nucleimedium

Easy Social Feed < 6.2.7 - Cross-Site Scripting

CVE-2021-25120—

Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting

18RIESGO

abrir ↗

Nucleimedium

Aruba Instant Access Point (IAP) - Cross-Site Scripting

CVE-2021-25161—

A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in ve

43RIESGO

abrir ↗

Nucleicritical

SaltStack Salt <3002.5 - Auth Bypass

CVE-2021-25281—

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel

40RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.