Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.150exploits catalogados
39.601CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9680Nuclei 4488Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4488 exploits
Nucleihigh
74cmsSE v3.4.1 - Arbitrary File Read
74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controlle
18RIESGO
abrir ↗Nucleihigh
All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side reques
48RIESGO
abrir ↗Nucleicritical
DotCMS - Arbitrary File Upload
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form req
100RIESGO
abrir ↗Nucleimedium
HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 p
18RIESGO
abrir ↗Nucleicritical
Mingsoft MCMS v5.2.7 - SQL Injection
Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
18RIESGO
abrir ↗Nucleicritical
Open Automation Software OAS Platform V16.00.0121 - Missing Authentication
An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V
55RIESGO
abrir ↗Nucleicritical
elFinder <=2.1.60 - Local File Inclusion
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote
30RIESGO
abrir ↗Nucleihigh
Yearning - Directory Traversal
Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal.
18RIESGO
abrir ↗Nucleicritical
Bitrix Site Manager - Remote Code Execution
In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can ex
23RIESGO
abrir ↗Nucleimedium
Openemr < 7.0.0.1 - Cross-Site Scripting
Cross-site Scripting (XSS) - Reflected in openemr/openemr
65RIESGO
abrir ↗Nucleimedium
Kavita <0.5.4.1 - Server-Side Request Forgery
Server-Side Request Forgery (SSRF) in kareadita/kavita
36RIESGO
abrir ↗Nucleicritical
QNAP QTS Photo Station External Reference - Local File Inclusion
DeadBolt Ransomware
95RIESGO
abrir ↗Nucleihigh
WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability
WordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerability
28RIESGO
abrir ↗Nucleihigh
Zimbra Collaboration Suite - Memcached Command Injection
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands i
95RIESGO
abrir ↗Nucleihigh
Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file
100RIESGO
abrir ↗Nucleimedium
Zimbra Collaboration (ZCS) - Cross Site Scripting
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboratio
63RIESGO
abrir ↗Nucleicritical
Microfinance Management System 1.0 - SQL Injection
A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application d
23RIESGO
abrir ↗Nucleicritical
Cuppa CMS v1.0 - SQL injection
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/te
18RIESGO
abrir ↗Nucleimedium
Wavlink WN-535G3 - Cross-Site Scripting
WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi
18RIESGO
abrir ↗Nucleicritical
School Dormitory Management System 1.0 - SQL Injection
School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.
18RIESGO
abrir ↗Nucleimedium
School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.p
18RIESGO
abrir ↗Nucleimedium
School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.p
18RIESGO
abrir ↗Nucleicritical
Zyxel Firewall - OS Command Injection
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RIESGO
abrir ↗Nucleimedium
Simple File List < 4.4.12 - Cross Site Scripting
Simple File List < 4.4.12 - Reflected Cross-Site Scripting
40RIESGO
abrir ↗Nucleimedium
Atmail 6.5.0 - Cross-Site Scripting
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.
18RIESGO
abrir ↗Nucleimedium
Parallels H-Sphere 3.6.1713 - Cross-Site Scripting
Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.
18RIESGO
abrir ↗Nucleihigh
Prestashop Blockwishlist 2.1.0 SQL Injection
SQL Injection in prestashop/blockwishlist
61RIESGO
abrir ↗Nucleicritical
Roxy-WI - Remote Code Execution
Unauthenticated Remote Code Execution in Roxy-wi
75RIESGO
abrir ↗Nucleicritical
Roxy-WI < 6.1.1.0 - Remote Code Execution
Unauthenticated Remote Code Execution in Roxy-WI
85RIESGO
abrir ↗Nucleicritical
Roxy-WI - Remote Code Execution
Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload
68RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.