Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.150exploits catalogados
39.601CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9680Nuclei 4488Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4488 exploits
Nucleimedium
Site Offline WP Plugin < 1.5.3 - Authorization Bypass
CVE-2022-1580—
Site Offline < 1.5.3 - Access Bypass
18RIESGO
abrir ↗
Nucleimedium
WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure
CVE-2022-1595—
HC Custom WP-Admin URL <= 1.4 - Unauthenticated Secret URL Disclosure
18RIESGO
abrir ↗
Nucleimedium
WordPress WPQA <5.4 - Cross-Site Scripting
CVE-2022-1597—
WPQA < 5.4 - Reflected Cross-Site Scripting
18RIESGO
abrir ↗
Nucleimedium
WordPress WPQA <5.5 - Improper Access Control
CVE-2022-1598—
WPQA < 5.5 - Unauthenticated Private Message Disclosure
18RIESGO
abrir ↗
Nucleicritical
The School Management < 9.9.7 - Remote Code Execution
CVE-2022-1609CRITICAL
The School Management < 9.9.7 - Unauthenticated RCE via REST api
75RIESGO
abrir ↗
Nucleicritical
CP Image Store with Slideshow <= 1.0.67 - SQL Injection
CVE-2022-1692—
CP Image Store with Slideshow < 1.0.68 - Unauthenticated SQLi
23RIESGO
abrir ↗
Nucleihigh
draw.io < 18.0.5 - Server Side Request Forgery (SSRF)
CVE-2022-1711HIGH
Server-Side Request Forgery (SSRF) in jgraph/drawio
36RIESGO
abrir ↗
Nucleihigh
Drawio <18.0.4 - Server-Side Request Forgery
CVE-2022-1713HIGH
SSRF on /proxy in jgraph/drawio
36RIESGO
abrir ↗
Nucleimedium
WordPress Simple Membership <4.1.1 - Cross-Site Scripting
CVE-2022-1724—
Simple Membership < 4.1.1 - Reflected Cross-Site Scripting
18RIESGO
abrir ↗
Nucleimedium
Newsletter < 7.4.5 - Cross-Site Scripting
CVE-2022-1756—
Newsletter < 7.4.5 - Reflected Cross-Site Scripting
18RIESGO
abrir ↗
Nucleihigh
WordPress RSVPMaker <=9.3.2 - SQL Injection
CVE-2022-1768CRITICAL
RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection
68RIESGO
abrir ↗
Nucleihigh
Drawio <18.1.2 - Server-Side Request Forgery
CVE-2022-1815MEDIUM
Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio
28RIESGO
abrir ↗
Nucleihigh
Terraboard <2.2.0 - SQL Injection
CVE-2022-1883CRITICAL
SQL Injection in camptocamp/terraboard
43RIESGO
abrir ↗
Nucleihigh
ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
CVE-2022-1903—
ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
18RIESGO
abrir ↗
Nucleimedium
WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting
CVE-2022-1904—
Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-Scripting
18RIESGO
abrir ↗
Nucleimedium
WordPress Copyright Proof <=4.16 - Cross-Site-Scripting
CVE-2022-1906—
Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting
18RIESGO
abrir ↗
Nucleimedium
WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting
CVE-2022-1910—
Shortcodes and extra features for Phlox theme < 2.9.8 - Reflected Cross-Site-Scripting
18RIESGO
abrir ↗
Nucleimedium
WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting
CVE-2022-1916—
Active Products Tables for WooCommerce < 1.0.5 - Reflected Cross-Site-Scripting
18RIESGO
abrir ↗
Nucleimedium
WordPress CDI <5.1.9 - Cross Site Scripting
CVE-2022-1933—
CDI < 5.1.9 - Reflected Cross-Site-Scripting
18RIESGO
abrir ↗
Nucleimedium
WordPress Awin Data Feed <=1.6 - Cross-Site Scripting
CVE-2022-1937—
Awin Data Feed < 1.8 - Reflected Cross-Site Scripting
18RIESGO
abrir ↗
Nucleimedium
WordPress Gallery <2.0.0 - Cross-Site Scripting
CVE-2022-1946—
Gallery < 2.0.0 - Reflected Cross-Site Scripting
18RIESGO
abrir ↗
Nucleicritical
Youzify < 1.2.0 - Unauthenticated SQLi
CVE-2022-1950—
Youzify < 1.2.0 - Unauthenticated SQLi
18RIESGO
abrir ↗
Nucleicritical
WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload
CVE-2022-1952—
eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload
23RIESGO
abrir ↗
Nucleimedium
WordPress Sensei LMS <4.5.0 - Information Disclosure
CVE-2022-2034—
Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API
18RIESGO
abrir ↗
Nucleimedium
Microweber < 1.2.17 - Cross-Site Scripting
CVE-2022-2130MEDIUM
Cross-site Scripting (XSS) - Reflected in microweber/microweber
28RIESGO
abrir ↗
Nucleihigh
Oracle WebLogic Server Local File Inclusion
CVE-2022-21371HIGH
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported ve
78RIESGO
abrir ↗
Nucleihigh
Oracle E-Business Suite <=12.2 - Authentication Bypass
CVE-2022-21500HIGH
Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Ea
58RIESGO
abrir ↗
Nucleicritical
Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution
CVE-2022-21587CRITICALbajo ataqueransomware
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).
100RIESGO
abrir ↗
Nucleihigh
WordPress <5.8.3 - SQL Injection
CVE-2022-21661HIGH
SQL injection in WordPress
78RIESGO
abrir ↗
Nucleimedium
WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting
CVE-2022-2168—
Download Manager < 3.2.44 - Reflected Cross-Site Scripting
18RIESGO
abrir ↗
← anteriorpágina 120 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.