Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.150exploits catalogados
39.601CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9680Nuclei 4488Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4488 exploits
Nucleimedium
Reprise License Manager 14.2 - Cross-Site Scripting
CVE-2022-28363—
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_pr
18RIESGO
abrir ↗
Nucleimedium
Reprise License Manager 14.2 - Information Disclosure
CVE-2022-28365—
Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminf
18RIESGO
abrir ↗
Nucleimedium
MantisBT < 2.25.2 - Cross-Site Scripting
CVE-2022-28508—
An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return param
18RIESGO
abrir ↗
Nucleimedium
WordPress WPvivid Backup <0.9.76 - Local File Inclusion
CVE-2022-2863—
WPvivid Backup < 0.9.76 - Admin+ Arbitrary File Read
23RIESGO
abrir ↗
Nucleimedium
Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update
CVE-2022-28666MEDIUM
WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.7 - Broken Access Control vulnerability
28RIESGO
abrir ↗
Nucleimedium
Caddy 2.4.6 - Open Redirect
CVE-2022-28923MEDIUM
Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phi
28RIESGO
abrir ↗
Nucleihigh
D-Link DIR-816L - Improper Access Control
CVE-2022-28955—
An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php an
30RIESGO
abrir ↗
Nucleimedium
Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration
CVE-2022-28987—
Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST req
23RIESGO
abrir ↗
Nucleimedium
Diary Management System 1.0 - Cross-Site Scripting
CVE-2022-29004—
Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter
18RIESGO
abrir ↗
Nucleimedium
Online Birth Certificate System 1.2 - Stored Cross-Site Scripting
CVE-2022-29005—
Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate
18RIESGO
abrir ↗
Nucleicritical
Directory Management System 1.0 - SQL Injection
CVE-2022-29006—
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Manageme
23RIESGO
abrir ↗
Nucleicritical
Dairy Farm Shop Management System 1.0 - SQL Injection
CVE-2022-29007—
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Ma
23RIESGO
abrir ↗
Nucleicritical
Cyber Cafe Management System 1.0 - SQL Injection
CVE-2022-29009—
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Managem
23RIESGO
abrir ↗
Nucleicritical
Razer Sila Gaming Router - Remote Code Execution
CVE-2022-29013—
A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execut
40RIESGO
abrir ↗
Nucleihigh
Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion
CVE-2022-29014—
A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary
23RIESGO
abrir ↗
Nucleicritical
Node.js Embedded JavaScript 3.1.6 - Template Injection
CVE-2022-29078—
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[
50RIESGO
abrir ↗
Nucleicritical
Zoho ManageEngine - Access Control Bypass
CVE-2022-29081—
Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnera
40RIESGO
abrir ↗
Nucleihigh
HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery
CVE-2022-29153—
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the C
18RIESGO
abrir ↗
Nucleimedium
Nagios XI <5.8.5 - Open Redirect
CVE-2022-29272—
In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.
18RIESGO
abrir ↗
Nucleihigh
SolarView Compact 6.00 - Local File Inclusion
CVE-2022-29298—
SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.
50RIESGO
abrir ↗
Nucleicritical
SolarView Compact 6.00 - OS Command Injection
CVE-2022-29303CRITICALbajo ataque
SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.
100RIESGO
abrir ↗
Nucleihigh
Complete Online Job Search System 1.0 - Cross-Site Scripting
CVE-2022-29316—
Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=res
18RIESGO
abrir ↗
Nucleimedium
kkFileView 4.0.0 - Cross-Site Scripting
CVE-2022-29349—
kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /control
18RIESGO
abrir ↗
Nucleicritical
NETGEAR ProSafe SSL VPN firmware - SQL Injection
CVE-2022-29383—
NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USE
50RIESGO
abrir ↗
Nucleimedium
WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting
CVE-2022-29455MEDIUM
WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability
33RIESGO
abrir ↗
Nucleicritical
WSO2 Management - Arbitrary File Upload & Remote Code Execution
CVE-2022-29464CRITICALbajo ataqueransomware
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RIESGO
abrir ↗
Nucleimedium
WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery
CVE-2022-29495MEDIUM
WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update
28RIESGO
abrir ↗
Nucleimedium
WSO2 - Cross-Site Scripting
CVE-2022-29548MEDIUM
A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0,
60RIESGO
abrir ↗
Nucleicritical
iSpy 7.2.2.0 - Authentication Bypass
CVE-2022-29775—
iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.
30RIESGO
abrir ↗
Nucleimedium
WBCE CMS 1.5.2 - Cross-Site Scripting
CVE-2022-30073—
WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.
18RIESGO
abrir ↗
← anteriorpágina 125 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.