Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.529exploits catalogados

39.725CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.739Exploit-DB 24.485GitHub PoC 16.607VulnCheck XDB 9680Nuclei 4493Metasploit 3525✓ solo verificadosrecientes populares riesgo

4493 exploits

Nucleimedium

Online Birth Certificate System 1.2 - Stored Cross-Site Scripting

CVE-2022-29005—

Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate

18RIESGO

abrir ↗

Nucleicritical

Directory Management System 1.0 - SQL Injection

CVE-2022-29006—

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Manageme

23RIESGO

abrir ↗

Nucleicritical

Dairy Farm Shop Management System 1.0 - SQL Injection

CVE-2022-29007—

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Ma

23RIESGO

abrir ↗

Nucleicritical

Cyber Cafe Management System 1.0 - SQL Injection

CVE-2022-29009—

Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Managem

23RIESGO

abrir ↗

Nucleicritical

Razer Sila Gaming Router - Remote Code Execution

CVE-2022-29013—

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execut

40RIESGO

abrir ↗

Nucleihigh

Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion

CVE-2022-29014—

A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary

23RIESGO

abrir ↗

Nucleicritical

Node.js Embedded JavaScript 3.1.6 - Template Injection

CVE-2022-29078—

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[

50RIESGO

abrir ↗

Nucleicritical

Zoho ManageEngine - Access Control Bypass

CVE-2022-29081—

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnera

40RIESGO

abrir ↗

Nucleihigh

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

CVE-2022-29153—

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the C

18RIESGO

abrir ↗

Nucleimedium

Nagios XI <5.8.5 - Open Redirect

CVE-2022-29272—

In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.

18RIESGO

abrir ↗

Nucleihigh

SolarView Compact 6.00 - Local File Inclusion

CVE-2022-29298—

SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.

50RIESGO

abrir ↗

Nucleicritical

SolarView Compact 6.00 - OS Command Injection

CVE-2022-29303CRITICALbajo ataque

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

100RIESGO

abrir ↗

Nucleihigh

Complete Online Job Search System 1.0 - Cross-Site Scripting

CVE-2022-29316—

Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=res

18RIESGO

abrir ↗

Nucleimedium

kkFileView 4.0.0 - Cross-Site Scripting

CVE-2022-29349—

kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /control

18RIESGO

abrir ↗

Nucleicritical

NETGEAR ProSafe SSL VPN firmware - SQL Injection

CVE-2022-29383—

NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USE

50RIESGO

abrir ↗

Nucleimedium

WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting

CVE-2022-29455MEDIUM

WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability

33RIESGO

abrir ↗

Nucleicritical

WSO2 Management - Arbitrary File Upload & Remote Code Execution

CVE-2022-29464CRITICALbajo ataqueransomware

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

Nucleimedium

WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery

CVE-2022-29495MEDIUM

WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update

28RIESGO

abrir ↗

Nucleimedium

WSO2 - Cross-Site Scripting

CVE-2022-29548MEDIUM

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0,

60RIESGO

abrir ↗

Nucleicritical

iSpy 7.2.2.0 - Authentication Bypass

CVE-2022-29775—

iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.

30RIESGO

abrir ↗

Nucleimedium

WBCE CMS 1.5.2 - Cross-Site Scripting

CVE-2022-30073—

WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.

18RIESGO

abrir ↗

Nucleimedium

Wavlink WN-535G3 - Cross-Site Scripting

CVE-2022-30489—

WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi

18RIESGO

abrir ↗

Nucleicritical

School Dormitory Management System 1.0 - SQL Injection

CVE-2022-30512—

School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.

18RIESGO

abrir ↗

Nucleimedium

School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting

CVE-2022-30513—

School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.p

18RIESGO

abrir ↗

Nucleimedium

School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting

CVE-2022-30514—

School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.p

18RIESGO

abrir ↗

Nucleicritical

Zyxel Firewall - OS Command Injection

CVE-2022-30525CRITICALbajo ataque

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat

100RIESGO

abrir ↗

Nucleimedium

Simple File List < 4.4.12 - Cross Site Scripting

CVE-2022-3062MEDIUM

Simple File List < 4.4.12 - Reflected Cross-Site Scripting

40RIESGO

abrir ↗

Nucleimedium

Atmail 6.5.0 - Cross-Site Scripting

CVE-2022-30776—

atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.

18RIESGO

abrir ↗

Nucleimedium

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting

CVE-2022-30777—

Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.

18RIESGO

abrir ↗

Nucleihigh

Prestashop Blockwishlist 2.1.0 SQL Injection

CVE-2022-31101HIGH

SQL Injection in prestashop/blockwishlist

61RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.