Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

72.018exploits catalogados
32.219CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8195Nuclei 4217Metasploit 3463✓ solo verificadosrecientespopularesriesgo
4217 exploits
Nucleimedium
Chamilo LMS <= 1.11.24 - Remote Code Execution
CVE-2023-4220HIGH
Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
78RIESGO
abrir ↗
Nucleimedium
OpenCMS - Cross-Site Scripting
CVE-2023-42343MEDIUM
A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
28RIESGO
abrir ↗
Nucleihigh
OpenCMS - XML external entity (XXE)
CVE-2023-42344HIGH
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/
56RIESGO
abrir ↗
Nucleimedium
JumpServer > 3.6.4 - Information Disclosure
CVE-2023-42442HIGH
JumpServer session replays download without authentication
48RIESGO
abrir ↗
Nucleicritical
JetBrains TeamCity < 2023.05.4 - Remote Code Execution
CVE-2023-42793CRITICALbajo ataqueransomware
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
100RIESGO
abrir ↗
Nucleihigh
WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting
CVE-2023-4284—
Post Timeline < 2.2.6 - Reflected XSS
18RIESGO
abrir ↗
Nucleicritical
CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution
CVE-2023-43177—
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes
60RIESGO
abrir ↗
Nucleicritical
NodeBB XML-RPC Request xmlrpc.php - XML Injection
CVE-2023-43187—
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.1
30RIESGO
abrir ↗
Nucleicritical
NextGen Healthcare Mirth Connect - Remote Code Execution
CVE-2023-43208CRITICALbajo ataqueransomware
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that
100RIESGO
abrir ↗
Nucleihigh
Milesight Routers - Information Disclosure
CVE-2023-43261HIGH
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensiti
68RIESGO
abrir ↗
Nucleimedium
mooSocial 3.1.8 - External Service Interaction
CVE-2023-43323—
mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP a
18RIESGO
abrir ↗
Nucleimedium
MooSocial 3.1.8 - Cross-Site Scripting
CVE-2023-43325—
A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows atta
18RIESGO
abrir ↗
Nucleimedium
MooSocial 3.1.8 - Cross-Site Scripting
CVE-2023-43326—
A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to ste
18RIESGO
abrir ↗
Nucleicritical
Hoteldruid v3.0.5 - SQL Injection
CVE-2023-43373CRITICAL
Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/
43RIESGO
abrir ↗
Nucleicritical
Hoteldruid v3.0.5 - SQL Injection
CVE-2023-43374CRITICAL
Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid
43RIESGO
abrir ↗
Nucleihigh
MLFlow < 2.8.1 - Sensitive Information Disclosure
CVE-2023-43472—
An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted requ
30RIESGO
abrir ↗
Nucleicritical
PyTorch TorchServe SSRF
CVE-2023-43654CRITICAL
TorchServe Server-Side Request Forgery
75RIESGO
abrir ↗
Nucleihigh
ShokoServer System - Local File Inclusion (LFI)
CVE-2023-43662HIGH
Arbitrary file read vulnerability in Shoko Server
36RIESGO
abrir ↗
Nucleicritical
GeoServer WPS - Server Side Request Forgery
CVE-2023-43795HIGH
WPS Server Side Request Forgery in GeoServer
48RIESGO
abrir ↗
Nucleimedium
mojoPortal v.2.7.0.0 - Cross-Site Scripting
CVE-2023-44012MEDIUM
Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the he
28RIESGO
abrir ↗
Nucleihigh
Ruijie RG-EW1200G Router Background - Login Bypass
CVE-2023-4415HIGH
Ruijie RG-EW1200G login improper authentication
48RIESGO
abrir ↗
Nucleimedium
Adobe Coldfusion - Cross-Site Scripting
CVE-2023-44352MEDIUM
Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version
50RIESGO
abrir ↗
Nucleicritical
Adobe ColdFusion WDDX Deserialization Gadgets
CVE-2023-44353CRITICAL
ColdFusion WDDX Deserialization Gadgets
65RIESGO
abrir ↗
Nucleimedium
Piwigo - Cross-Site Scripting
CVE-2023-44393CRITICAL
Piwigo Reflected XSS vulnerability
43RIESGO
abrir ↗
Nucleicritical
JeecgBoot JimuReport - Template injection
CVE-2023-4450MEDIUM
jeecgboot JimuReport Template injection
53RIESGO
abrir ↗
Nucleimedium
Cockpit - Cross-Site Scripting
CVE-2023-4451MEDIUM
Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit
28RIESGO
abrir ↗
Nucleimedium
mooSocial v.3.1.8 - Cross-Site Scripting
CVE-2023-44812—
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a c
18RIESGO
abrir ↗
Nucleimedium
mooSocial v.3.1.8 - Cross-Site Scripting
CVE-2023-44813—
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a c
18RIESGO
abrir ↗
Nucleihigh
WordPress Job Portal < 2.0.6 - SQL Injection
CVE-2023-4490CRITICAL
WP Job Portal < 2.0.6 - Unauthenticated SQLi
63RIESGO
abrir ↗
Nucleimedium
WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure
CVE-2023-44982MEDIUM
WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure
28RIESGO
abrir ↗
← anteriorpágina 135 / 141siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.