Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.600exploits catalogados
39.734CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.742Exploit-DB 24.486GitHub PoC 16.618VulnCheck XDB 9736Nuclei 4493Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4493 exploits
Nucleimedium
Stable Diffusion Webui 1.10.0 - Open Redirect
CVE-2024-11044MEDIUM
Open Redirect in automatic1111/stable-diffusion-webui
28RIESGO
abrir ↗
Nucleimedium
Landray EKP - Path Traversal
CVE-2024-11238MEDIUM
Landray EKP sysUiComponent.do delPreviewFile path traversal
28RIESGO
abrir ↗
Nucleihigh
Korenix JetPort 5601v3 - Path Traversal
CVE-2024-11303HIGH
Path Traversal
36RIESGO
abrir ↗
Nucleimedium
Altenergy Power Control Software - SQL Injection
CVE-2024-11305MEDIUM
Altenergy Power Control Software status_zigbee get_status_zigbee sql injection
28RIESGO
abrir ↗
Nucleicritical
Pandora v7.0NG.777.3 - Remote Code Execution
CVE-2024-11320MEDIUM
Command Injection leading to RCE via LDAP Misconfiguration
50RIESGO
abrir ↗
Nucleimedium
Event Monster <= 1.4.3 - Information Exposure Via Visitors List Export
CVE-2024-11396MEDIUM
Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
28RIESGO
abrir ↗
Nucleimedium
idcCMS V1.60 - Cross-Site Scripting
CVE-2024-11587MEDIUM
idcCMS classProvCity.php GetCityOptionJs cross site scripting
28RIESGO
abrir ↗
Nucleicritical
ProjectSend <= r1605 - Improper Authorization
CVE-2024-11680CRITICALbajo ataque
ProjectSend Unauthenticated Configuration Modification
100RIESGO
abrir ↗
Nucleihigh
KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection
CVE-2024-11728HIGH
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
61RIESGO
abrir ↗
Nucleihigh
Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution
CVE-2024-11740HIGH
Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution
36RIESGO
abrir ↗
Nucleimedium
Gradio - Server Side Request Forgery
CVE-2024-1183MEDIUM
SSRF Vulnerability in gradio-app/gradio
28RIESGO
abrir ↗
Nucleimedium
LearnPress < 4.2.7.4 - Course Material - Information Disclosure
CVE-2024-11868MEDIUM
LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API
28RIESGO
abrir ↗
Nucleihigh
Give WP Plugin < 3.19.0 - Cross-Site Scripting
CVE-2024-11921MEDIUM
Give < 3.19.0 - Reflected XSS
28RIESGO
abrir ↗
Nucleicritical
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
CVE-2024-11972CRITICAL
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
75RIESGO
abrir ↗
Nucleimedium
W3 Total Cache < 2.8.2 - Log File Exposure
CVE-2024-12008MEDIUM
W3 Total Cache <= 2.8.1 Information Exposure via Log Files
28RIESGO
abrir ↗
Nucleihigh
WordPress Collapsing Categories <= 3.0.8 - SQL Injection
CVE-2024-12025HIGH
Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection
56RIESGO
abrir ↗
Nucleimedium
LearnDash LMS < 4.10.3 - Sensitive Information Exposure
CVE-2024-1208MEDIUM
LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API
28RIESGO
abrir ↗
Nucleimedium
LearnDash LMS < 4.10.2 - Sensitive Information Exposure via assignments
CVE-2024-1209MEDIUM
LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments
28RIESGO
abrir ↗
Nucleimedium
LearnDash LMS < 4.10.2 - Sensitive Information Exposure
CVE-2024-1210MEDIUM
LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API
28RIESGO
abrir ↗
Nucleicritical
Progress Kemp LoadMaster - Command Injection
CVE-2024-1212CRITICALbajo ataque
LoadMaster Pre-Authenticated OS Command Injection
100RIESGO
abrir ↗
Nucleicritical
WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion
CVE-2024-12209CRITICAL
WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion
68RIESGO
abrir ↗
Nucleimedium
PropertyHive < 2.1.1 - Cross-Site Scripting
CVE-2024-12585MEDIUM
PropertyHive < 2.1.1 - Reflected XSS
28RIESGO
abrir ↗
Nucleihigh
Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting
CVE-2024-12638HIGH
Bulk Me Now <= 2.0 - Reflected XSS
36RIESGO
abrir ↗
Nucleimedium
WP DeskLite - Reflected XSS
CVE-2024-12724MEDIUM
WP DeskLite <= 1.0.0 - Reflected XSS
28RIESGO
abrir ↗
Nucleimedium
AffiliateImporterEb <= 1.0.6 - Reflected XSS
CVE-2024-12732MEDIUM
AffiliateImporterEb <= 1.0.6 - Reflected XSS
28RIESGO
abrir ↗
Nucleimedium
Advance Post Prefix WordPress plugin - Reflected XSS
CVE-2024-12734MEDIUM
Advance Post Prefix <= 1.1.1 - Reflected XSS
28RIESGO
abrir ↗
Nucleihigh
Apache HugeGraph-Server - Remote Command Execution
CVE-2024-27348CRITICALbajo ataque
Apache HugeGraph-Server: Command execution in gremlin
100RIESGO
abrir ↗
Nucleimedium
Zimbra Collaboration - Cross-Site Scripting (XSS)
CVE-2024-27443MEDIUMbajo ataque
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in
63RIESGO
abrir ↗
Nucleihigh
Linksys E2000 1.0.06 position.js Improper Authentication
CVE-2024-27497HIGH
Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.
41RIESGO
abrir ↗
Nucleihigh
ChatGPT个人专用版 - Server Side Request Forgery
CVE-2024-27564MEDIUM
pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references sec
60RIESGO
abrir ↗
← anteriorpágina 135 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.