Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.150exploits catalogados
39.601CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9680Nuclei 4488Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4488 exploits
Nucleicritical
Mura CMS <10.0.580 - Authentication Bypass
CVE-2022-47003CRITICAL
A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a
43RIESGO
abrir ↗
Nucleihigh
Smart Office Web 20.28 - Information Disclosure
CVE-2022-47075HIGH
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the
68RIESGO
abrir ↗
Nucleihigh
Apache OFBiz < 18.12.07 - Local File Inclusion
CVE-2022-47501HIGH
Apache OFBiz: Arbitrary file reading vulnerability
41RIESGO
abrir ↗
Nucleicritical
LearnPress Plugin < 4.2.0 - Local File Inclusion
CVE-2022-47615CRITICAL
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion
63RIESGO
abrir ↗
Nucleicritical
Thinkphp Lang - Local File Inclusion
CVE-2022-47945CRITICAL
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is en
48RIESGO
abrir ↗
Nucleicritical
ManageEngine - Remote Command Execution
CVE-2022-47966CRITICALbajo ataqueransomware
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due
100RIESGO
abrir ↗
Nucleicritical
IBM Aspera Faspex <=4.4.2 PL1 - Remote Code Execution
CVE-2022-47986CRITICALbajo ataqueransomware
IBM Aspera Faspex code execution
100RIESGO
abrir ↗
Nucleimedium
OpenCATS 0.9.7 - Cross-Site Scripting
CVE-2022-48012MEDIUM
Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openca
28RIESGO
abrir ↗
Nucleihigh
Wavlink WL-WN533A8 M33A8.V5030.190716 - Information Disclosure
CVE-2022-48164HIGH
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthen
36RIESGO
abrir ↗
Nucleihigh
Wavlink - Improper Access Control
CVE-2022-48165—
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthen
18RIESGO
abrir ↗
Nucleihigh
Wavlink WL-WN530HG4 M30HG4.V5030.201217 - Information Disclosure
CVE-2022-48166HIGH
An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configur
36RIESGO
abrir ↗
Nucleimedium
Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting
CVE-2022-48197—
Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, Tree
38RIESGO
abrir ↗
Nucleicritical
Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution
CVE-2022-48323CRITICAL
Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A
75RIESGO
abrir ↗
Nucleimedium
WordPress BackupBuddy <8.8.3 - Cross Site Scripting
CVE-2022-4897MEDIUM
BackupBuddy < 8.8.3 - Multiple Reflected Cross-Site Scripting
28RIESGO
abrir ↗
Nucleihigh
WCFM Membership <= 2.10.0 - Broken Access Control
CVE-2022-4940HIGH
WCFM Membership <= 2.10.0 - Missing Authorization
36RIESGO
abrir ↗
Nucleimedium
Sassy Social Share <= 3.3.3 - Cross-Site Scripting
CVE-2022-4971MEDIUM
Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting
33RIESGO
abrir ↗
Nucleicritical
WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection
CVE-2023-0037CRITICAL
10WebMapBuilder < 1.0.73 - Unauthenticated SQLi
63RIESGO
abrir ↗
Nucleimedium
Simple URLs < 115 - Cross Site Scripting
CVE-2023-0099—
Simple URLs < 115 - Multiple Reflected XSS
18RIESGO
abrir ↗
Nucleihigh
SonicWall SMA1000 LFI
CVE-2023-0126HIGH
Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated atta
58RIESGO
abrir ↗
Nucleihigh
Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE
CVE-2023-0159—
Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE
50RIESGO
abrir ↗
Nucleimedium
WordPress Tutor LMS <2.0.10 - Cross Site Scripting
CVE-2023-0236MEDIUM
Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting
28RIESGO
abrir ↗
Nucleihigh
WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection
CVE-2023-0261HIGH
WP TripAdvisor Review Slider < 10.8 - Subscriber+ SQLi
36RIESGO
abrir ↗
Nucleicritical
PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
CVE-2023-0297CRITICAL
Code Injection in pyload/pyload
85RIESGO
abrir ↗
Nucleimedium
ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting
CVE-2023-0334MEDIUM
ShortPixel Adaptive Images < 3.6.3 - Reflected XSS
28RIESGO
abrir ↗
Nucleimedium
WP Helper Lite < 4.3 - Cross-Site Scripting
CVE-2023-0448MEDIUM
The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resultin
40RIESGO
abrir ↗
Nucleimedium
Membership Database <= 1.0 - Cross-Site Scripting
CVE-2023-0514MEDIUM
Membership Database <= 1.0 - Reflected XSS
28RIESGO
abrir ↗
Nucleimedium
Online Security Guards Hiring System - Cross-Site Scripting
CVE-2023-0527LOW
PHPGurukul Online Security Guards Hiring System search-request.php cross site scripting
43RIESGO
abrir ↗
Nucleimedium
WordPress Pie Register <3.8.2.3 - Open Redirect
CVE-2023-0552MEDIUM
Pie Register < 3.8.2.3 - Open Redirect
33RIESGO
abrir ↗
Nucleicritical
Bank Locker Management System v1.0 - SQL Injection
CVE-2023-0562HIGH
PHPGurukul Bank Locker Management System Login index.php sql injection
48RIESGO
abrir ↗
Nucleimedium
Request-Baskets <= 1.2.1 - Server Side Request Forgery
CVE-2023-27163MEDIUM
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RIESGO
abrir ↗
← anteriorpágina 127 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.