Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
71.957exploits catalogados
32.195CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8182Nuclei 4217Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4217 exploits
Nucleicritical
NETGEAR ProSafe SSL VPN firmware - SQL Injection
NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USE
50RIESGO
abrir ↗Nucleimedium
WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting
WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability
33RIESGO
abrir ↗Nucleicritical
WSO2 Management - Arbitrary File Upload & Remote Code Execution
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RIESGO
abrir ↗Nucleimedium
WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery
WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update
28RIESGO
abrir ↗Nucleimedium
WSO2 - Cross-Site Scripting
A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0,
60RIESGO
abrir ↗Nucleicritical
iSpy 7.2.2.0 - Authentication Bypass
iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.
30RIESGO
abrir ↗Nucleimedium
WBCE CMS 1.5.2 - Cross-Site Scripting
WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.
18RIESGO
abrir ↗Nucleimedium
Wavlink WN-535G3 - Cross-Site Scripting
WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi
18RIESGO
abrir ↗Nucleicritical
School Dormitory Management System 1.0 - SQL Injection
School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.
18RIESGO
abrir ↗Nucleimedium
School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.p
18RIESGO
abrir ↗Nucleimedium
School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.p
18RIESGO
abrir ↗Nucleicritical
Zyxel Firewall - OS Command Injection
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RIESGO
abrir ↗Nucleimedium
Simple File List < 4.4.12 - Cross Site Scripting
Simple File List < 4.4.12 - Reflected Cross-Site Scripting
40RIESGO
abrir ↗Nucleimedium
Atmail 6.5.0 - Cross-Site Scripting
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.
18RIESGO
abrir ↗Nucleimedium
Parallels H-Sphere 3.6.1713 - Cross-Site Scripting
Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.
18RIESGO
abrir ↗Nucleihigh
Prestashop Blockwishlist 2.1.0 SQL Injection
SQL Injection in prestashop/blockwishlist
61RIESGO
abrir ↗Nucleicritical
Roxy-WI - Remote Code Execution
Unauthenticated Remote Code Execution in Roxy-wi
75RIESGO
abrir ↗Nucleicritical
Roxy-WI < 6.1.1.0 - Remote Code Execution
Unauthenticated Remote Code Execution in Roxy-WI
85RIESGO
abrir ↗Nucleicritical
Roxy-WI - Remote Code Execution
Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload
68RIESGO
abrir ↗Nucleicritical
PrestaShop - SQL Injection to Eval Injection
Remote code execution in prestashop
63RIESGO
abrir ↗Nucleimedium
Frontend File Manager < 21.3 - Unauthenticated File Renaming
Frontend File Manager < 21.3 - Unauthenticated File Renaming
18RIESGO
abrir ↗Nucleimedium
ResourceSpace - Metadata Export
In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collectio
18RIESGO
abrir ↗Nucleihigh
Gitblit 1.9.3 - Local File Inclusion
A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by
23RIESGO
abrir ↗Nucleihigh
Linear eMerge E3-Series - Information Disclosure
Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to o
18RIESGO
abrir ↗Nucleimedium
Haraj 3.7 - Cross-Site Scripting
Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form.
18RIESGO
abrir ↗Nucleimedium
SolarView Compact 6.00 - Cross-Site Scripting
SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiCo
18RIESGO
abrir ↗Nucleihigh
NEX-Forms Plugin < 7.9.7 - SQL Injection
NEX-Forms < 7.9.7 - Authenticated SQLi
43RIESGO
abrir ↗Nucleimedium
Axigen WebMail - Cross-Site Scripting
An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12
50RIESGO
abrir ↗Nucleihigh
BackupBuddy - Local File Inclusion
WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal
48RIESGO
abrir ↗Nucleicritical
Nortek Linear eMerge E3-Series <0.32-08f - Remote Command Injection
Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via Reade
30RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.