Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.554exploits catalogados
39.165CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB
Xerte 3.9 - Remote Code Execution (RCE) (Authenticated)
An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupl
28RIESGO
abrir ↗Exploit-DB
Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)
ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads t
43RIESGO
abrir ↗Exploit-DB
Casdoor 1.13.0 - SQL Injection (Unauthenticated)
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as d
50RIESGO
abrir ↗Exploit-DB
ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 - Remote File CRUD
On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, dele
35RIESGO
abrir ↗Exploit-DB
Thinfinity VirtualUI 2.5.26.2 - Information Disclosure
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vuln
28RIESGO
abrir ↗Exploit-DB
Thinfinity VirtualUI 2.5.41.0 - IFRAME Injection
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection vi
50RIESGO
abrir ↗Exploit-DB
WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated)
WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting
28RIESGO
abrir ↗Exploit-DB
FileCloud 21.2 - Cross-Site Request Forgery (CSRF)
In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).
23RIESGO
abrir ↗Exploit-DB
WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated)
Perfect Survey < 1.5.2 - Unauthenticated SQL Injection
60RIESGO
abrir ↗Exploit-DB
Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS)
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0
53RIESGO
abrir ↗Exploit-DB
WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation
MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
60RIESGO
abrir ↗Exploit-DB
Hotel Druid 3.0.3 - Remote Code Execution (RCE)
HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attack
35RIESGO
abrir ↗Exploit-DB
ServiceNow - Username Enumeration
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending
28RIESGO
abrir ↗Exploit-DB
WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)
Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing
23RIESGO
abrir ↗Exploit-DB
WordPress Plugin Secure Copy Content Protection and Content Locking 2.8.1 - SQL-Injection (Unauthenticated)
Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection
60RIESGO
abrir ↗Exploit-DB
Hospital Management Startup 1.0 - 'Multiple' SQLi
HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.
23RIESGO
abrir ↗Exploit-DB
AtomCMS v2.0 - SQLi
AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.
50RIESGO
abrir ↗Exploit-DB
Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion
Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2
50RIESGO
abrir ↗Exploit-DB
Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s
60RIESGO
abrir ↗Exploit-DB
WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS)
CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting
23RIESGO
abrir ↗Exploit-DB
WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting
23RIESGO
abrir ↗Exploit-DB
Hospital Management System 4.0 - 'multiple' SQL Injection
Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-m
23RIESGO
abrir ↗Exploit-DB
FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE)
A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor use
23RIESGO
abrir ↗Exploit-DB
Servisnet Tessa - Privilege Escalation (Metasploit)
An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request.
28RIESGO
abrir ↗Exploit-DB
Servisnet Tessa - MQTT Credentials Dump (Unauthenticated) (Metasploit)
An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/u
28RIESGO
abrir ↗Exploit-DB
WordPress Plugin Domain Check 1.0.16 - Reflected Cross-Site Scripting (XSS) (Authenticated)
Domain Check < 1.0.17 - Reflected Cross-Site Scripting
43RIESGO
abrir ↗Exploit-DB
Moodle 3.11.4 - SQL Injection
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web serv
35RIESGO
abrir ↗Exploit-DB
WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming
LearnPress < 4.1.5 - Arbitrary Image Renaming
23RIESGO
abrir ↗Exploit-DB
Wordpress Plugin 404 to 301 2.0.2 - SQL-Injection (Authenticated)
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
50RIESGO
abrir ↗Exploit-DB
Mozilla Firefox 67 - Array.pop JIT Type Confusion
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow
83RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.