Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.554exploits catalogados
39.165CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB
Wavlink WN530HG4 - Password Disclosure
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via v
43RIESGO
abrir ↗Exploit-DB
Easy Chat Server 3.1 - Remote Stack Buffer Overflow (SEH)
chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username
60RIESGO
abrir ↗Exploit-DB
WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download
Duplicator < 1.4.7 - Unauthenticated Backup Download
43RIESGO
abrir ↗Exploit-DB
Wavlink WN533A8 - Password Disclosure
An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via vie
43RIESGO
abrir ↗Exploit-DB
Wavlink WN533A8 - Cross-Site Scripting (XSS)
Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via th
38RIESGO
abrir ↗Exploit-DB
Dingtian-DT-R002 3.1.276A - Authentication Bypass
relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post reques
38RIESGO
abrir ↗Exploit-DB
rpc.py 0.6.0 - Remote Code Execution (RCE)
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header i
35RIESGO
abrir ↗Exploit-DB
CodoForum v5.1 - Remote Code Execution (RCE)
Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin
50RIESGO
abrir ↗Exploit-DB
IOTransfer 4.0 - Remote Code Execution (RCE)
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary
35RIESGO
abrir ↗Exploit-DB
OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE)
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.
28RIESGO
abrir ↗Exploit-DB
Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)
Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.
35RIESGO
abrir ↗Exploit-DB
Nginx 1.20.0 - Denial of Service (DOS)
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from t
35RIESGO
abrir ↗Exploit-DB
WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)
A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0,
60RIESGO
abrir ↗Exploit-DB
Virtua Software Cobranca 12S - SQLi
Virtua Cobranca before 12R allows SQL Injection on the login page.
50RIESGO
abrir ↗Exploit-DB
Marval MSM v14.19.0.12476 - Remote Code Execution (RCE) (Authenticated)
Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.
35RIESGO
abrir ↗Exploit-DB
Marval MSM v14.19.0.12476 - Cross-Site Request Forgery (CSRF)
Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending
23RIESGO
abrir ↗Exploit-DB
ChurchCRM 4.4.5 - SQLi
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.
23RIESGO
abrir ↗Exploit-DB
Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators t
35RIESGO
abrir ↗Exploit-DB
Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)
Code Injection in Sourcegraph
78RIESGO
abrir ↗Exploit-DB
Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)
A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attack
23RIESGO
abrir ↗Exploit-DB
Confluence Data Center 7.18.0 - Remote Code Execution (RCE)
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RIESGO
abrir ↗Exploit-DB
Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute
60RIESGO
abrir ↗Exploit-DB
SolarView Compact 6.00 - Directory Traversal
SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.
50RIESGO
abrir ↗Exploit-DB
Microweber CMS 1.2.15 - Account Takeover
Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber
33RIESGO
abrir ↗Exploit-DB
Zyxel USG FLEX 5.21 - OS Command Injection
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2)
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code
60RIESGO
abrir ↗Exploit-DB
m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)
Insufficient file checks in m1k1o/blog
41RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.