Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
78.794exploits catalogados
36.057CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.459Referência 22.721GitHub PoC 14.946VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
24.459 exploits
Exploit-DB
Tree Page View Plugin 1.6.7 - Cross Site Scripting (XSS)
WordPress CMS Tree Page View Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)
56RIESGO
abrir ↗Exploit-DB
File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)
File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode
50RIESGO
abrir ↗Exploit-DB
STARFACE 7.3.0.10 - Authentication with Password Hash Possible
RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the
41RIESGO
abrir ↗Exploit-DB
Pydio Cells 4.1.2 - Server-Side Request Forgery
Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which
33RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Online Security Guards Hiring System 1.0 - Reflected XSS
PHPGurukul Online Security Guards Hiring System search-request.php cross site scripting
43RIESGO
abrir ↗Exploit-DB
Flexense HTTP Server 10.6.24 - Buffer Overflow (DoS) (Metasploit)
An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access v
60RIESGO
abrir ↗Exploit-DB
Pydio Cells 4.1.2 - Unauthorised Role Assignments
Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying t
46RIESGO
abrir ↗Exploit-DB
Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download
Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are genera
33RIESGO
abrir ↗Exploit-DB
unilogies/bumsys v1.0.3 beta - Unrestricted File Upload
Unrestricted Upload of File with Dangerous Type in unilogies/bumsys
41RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Faculty Evaluation System 1.0 - Unauthenticated File Upload
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_u
61RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats para
60RIESGO
abrir ↗Exploit-DB
Filmora 12 version ( Build 1.0.0.7) - Unquoted Service Paths Privilege Escalation
Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the comp
41RIESGO
abrir ↗Exploit-DB
SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)
A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute
33RIESGO
abrir ↗Exploit-DB
Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS comman
53RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's securit
23RIESGO
abrir ↗Exploit-DB
PnPSCADA v2.x - Unauthenticated PostgreSQL Injection
The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL
48RIESGO
abrir ↗Exploit-DB
Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informat
48RIESGO
abrir ↗Exploit-DB
FusionInvoice 2023-1.0 - Stored XSS (Cross-Site Scripting)
Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitr
33RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
GetSimple CMS v3.3.16 - Remote Code Execution (RCE)
GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file paramete
46RIESGO
abrir ↗Exploit-DB
ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)
ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
33RIESGO
abrir ↗Exploit-DB
CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)
Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to exe
33RIESGO
abrir ↗Exploit-DB
MobileTrans 4.0.11 - Weak Service Privilege Escalation
Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the exe
41RIESGO
abrir ↗Exploit-DB
PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui
100RIESGO
abrir ↗Exploit-DB
eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to d
41RIESGO
abrir ↗Exploit-DB
Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').
41RIESGO
abrir ↗Exploit-DB
eScan Management Console 14.0.1400.2281 - Cross Site Scripting
Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allo
48RIESGO
abrir ↗Exploit-DB
Apache Superset 2.0.0 - Authentication Bypass
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
100RIESGO
abrir ↗Exploit-DB
Optoma 1080PSTX Firmware C02 - Authentication Bypass
An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid cr
60RIESGO
abrir ↗Exploit-DB
Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_pro
41RIESGO
abrir ↗Exploit-DB
FLEX 1080 < 1085 Web 1.6.0 - Denial of Service
TEM FLEX-1085 reboot denial of service
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.