Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
24.458 exploits
Exploit-DB✓ VexDay Proof
Rocket.Chat 3.12.1 - NoSQL Injection (Unauthenticated)
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RIESGO
abrir ↗Exploit-DB
IcoFX 2.6 - '.ico' Buffer Overflow SEH + DEP Bypass using JOP
Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCoun
50RIESGO
abrir ↗Exploit-DB
Monstra CMS 3.0.4 - Remote Code Execution (Authenticated)
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but
28RIESGO
abrir ↗Exploit-DB
4Images 1.8 - 'redirect' Reflected XSS
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to in
23RIESGO
abrir ↗Exploit-DB
Seo Panel 4.8.0 - 'from_time' Reflected XSS
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and th
23RIESGO
abrir ↗Exploit-DB
CHIYU IoT Devices - Denial of Service (DoS)
A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including B
35RIESGO
abrir ↗Exploit-DB
CHIYU IoT Devices - 'Telnet' Authentication Bypass
An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Tec
35RIESGO
abrir ↗Exploit-DB
FUDForum 3.1.0 - 'author' Reflected XSS
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "
38RIESGO
abrir ↗Exploit-DB
FUDForum 3.1.0 - 'srch' Reflected XSS
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "
38RIESGO
abrir ↗Exploit-DB
Seo Panel 4.8.0 - 'category' Reflected XSS
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and
23RIESGO
abrir ↗Exploit-DB
Seo Panel 4.8.0 - 'search_name' Reflected XSS
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and t
23RIESGO
abrir ↗Exploit-DB
GetSimple CMS 3.3.4 - Information Disclosure
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<user
28RIESGO
abrir ↗Exploit-DB
Products.PluggableAuthService 2.6.0 - Open Redirect
URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService
33RIESGO
abrir ↗Exploit-DB
Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was disco
100RIESGO
abrir ↗Exploit-DB
Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th
100RIESGO
abrir ↗Exploit-DB
LogonTracer 1.2.0 - Remote Code Execution (Unauthenticated)
LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
60RIESGO
abrir ↗Exploit-DB
Trixbox 2.8.0.4 - 'lang' Path Traversal
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
PHPFusion 9.03.50 - Remote Code Execution
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a cr
50RIESGO
abrir ↗Exploit-DB
Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)
trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php
50RIESGO
abrir ↗Exploit-DB
WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS)
LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated)
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
60RIESGO
abrir ↗Exploit-DB
Codiad 2.8.4 - Remote Code Execution (Authenticated) (3)
Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.
28RIESGO
abrir ↗Exploit-DB
WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)
ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)
23RIESGO
abrir ↗Exploit-DB
Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)
Microsoft Exchange Server Remote Code Execution Vulnerability
100RIESGO
abrir ↗Exploit-DB
DELL dbutil_2_3.sys 2.3 - Arbitrary Write to Local Privilege Escalation (LPE)
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
98RIESGO
abrir ↗Exploit-DB
Solaris SunSSH 11.0 x86 - libpam Remote Root (2)
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve
100RIESGO
abrir ↗Exploit-DB
WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)
Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)
38RIESGO
abrir ↗Exploit-DB
Microsoft Exchange 2019 - Unauthenticated Email Download
Microsoft Exchange Server Remote Code Execution Vulnerability
100RIESGO
abrir ↗Exploit-DB
Subrion CMS 4.2.1 - Arbitrary File Upload
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, beca
50RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.