Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

72.018exploits catalogados

32.219CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8195Nuclei 4217Metasploit 3463✓ solo verificadosrecientes populares riesgo

4217 exploits

Nucleicritical

WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass

CVE-2023-6875CRITICAL

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API

85RIESGO

Nucleicritical

Hikvision IP ping.php - Command Execution

CVE-2023-6895MEDIUM

Hikvision Intercom Broadcasting System ping.php os command injection

70RIESGO

Nucleihigh

Mlflow <2.9.2 - Path Traversal

CVE-2023-6909HIGH

Path Traversal: '\..\filename' in mlflow/mlflow

58RIESGO

Nucleicritical

Better Search Replace < 1.4.5 - PHP Object Injection

CVE-2023-6933HIGH

Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

68RIESGO

Nucleimedium

WP Recipe Maker <= 9.1.0 - Reflected XSS via Referer Header

CVE-2023-6970MEDIUM

WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer

28RIESGO

Nucleihigh

Mlflow <2.8.0 - Local File Inclusion

CVE-2023-6977CRITICAL

Path Traversal: '\..\filename'

43RIESGO

Nucleicritical

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion

CVE-2023-6989CRITICAL

Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion

55RIESGO

Nucleihigh

GitLab - Account Takeover via Password Reset

CVE-2023-7028CRITICALbajo ataque

Weak Password Recovery Mechanism for Forgotten Password in GitLab

100RIESGO

Nucleimedium

WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection

CVE-2023-7116MEDIUM

WeiYe-Jing datax-web HTTP POST Request killJob os command injection

28RIESGO

Nucleihigh

WordPress BackWPup < 4.0.4 - Backup File Disclosure

CVE-2023-7164HIGH

BackWPup < 4.0.4 - Unauthenticated Backup Download

36RIESGO

Nucleihigh

JetBackup <= 2.0.9.7 - Sensitive Information Exposure via Directory Listing

CVE-2023-7165HIGH

JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

36RIESGO

Nucleimedium

System Dashboard < 2.8.10 - Cross-Site Scripting

CVE-2023-7246MEDIUM

System Dashboard < 2.8.10 - XSS via Header Injection

28RIESGO

Nucleihigh

Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read

CVE-2023-7327HIGH

Ozeki SMS Gateway <= 10.3.208 Unauthenticated Arbitrary File Read

36RIESGO

Nucleicritical

JS Help Desk <= 2.8.2 - SQL Injection

CVE-2023-7337HIGH

JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie

36RIESGO

Nucleicritical

PAN-OS Management Web Interface - Authentication Bypass

CVE-2024-0012CRITICALbajo ataqueransomware

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

100RIESGO

Nucleicritical

SpiderFlow Crawler Platform - Remote Code Execution

CVE-2024-0195MEDIUM

spider-flow FunctionController.java FunctionService.saveFunction code injection

33RIESGO

Nucleicritical

Github Enterprise Authenticated Remote Code Execution

CVE-2024-0200HIGH

Unsafe Reflection in Github Enterprise Server leading to Command Injection

58RIESGO

Nucleicritical

Fortra GoAnywhere MFT - Authentication Bypass

CVE-2024-0204CRITICAL

Authentication Bypass in GoAnywhere MFT

85RIESGO

Nucleimedium

EventON (Free < 2.2.8, Premium < 4.5.5) - Information Disclosure

CVE-2024-0235MEDIUM

EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure

60RIESGO

Nucleimedium

Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect

CVE-2024-0250MEDIUM

Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect

28RIESGO

Nucleihigh

Ncast busiFacade - Remote Command Execution

CVE-2024-0305MEDIUM

Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosure

60RIESGO

Nucleimedium

Travelpayouts <= 1.1.16 - Open Redirect

CVE-2024-0337MEDIUM

Travelpayouts <= 1.1.15 - Open Redirect

28RIESGO

Nucleicritical

Likeshop < 2.5.7.20210311 - Arbitrary File Upload

CVE-2024-0352HIGH

Likeshop HTTP POST Request File.php userFormImage unrestricted upload

78RIESGO

Nucleimedium

WordPress Simple Job Board - Unauthorized Data Access

CVE-2024-0593MEDIUM

Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure

28RIESGO

Nucleihigh

SolarWinds Security Event Manager - Unauthenticated RCE

CVE-2024-0692HIGH

SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

78RIESGO

Nucleicritical

Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection

CVE-2024-0705CRITICAL

Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection

43RIESGO

Nucleihigh

Monitorr Services Configuration - Arbitrary File Upload

CVE-2024-0713—

15RIESGO

Nucleicritical

Arcserve Unified Data Protection - Authentication Bypass

CVE-2024-0799CRITICAL

Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

43RIESGO

Nucleihigh

Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dll

CVE-2024-0801HIGH

Unauthenticated DoS in Arcserve Unified Data Protection

48RIESGO

Nucleimedium

Combo Blocks < 2.2.76 - Improper Access Control

CVE-2024-0881MEDIUM

Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access

33RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.