Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.655exploits catalogados

39.248CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.347Exploit-DB 24.485GitHub PoC 16.178VulnCheck XDB 9644Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

4478 exploits

Nucleimedium

Cacti - Cross-Site Scripting

CVE-2021-26247—

As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" t

18RIESGO

abrir ↗

Nucleihigh

AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure

CVE-2021-26294—

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal

23RIESGO

abrir ↗

Nucleicritical

Apache OFBiz <17.12.06 - Arbitrary Code Execution

CVE-2021-26295—

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

60RIESGO

abrir ↗

Nucleimedium

EPrints 3.4.2 - Cross-Site Scripting

CVE-2021-26475—

EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.

18RIESGO

abrir ↗

Nucleimedium

ImpressCMS <1.4.3 - Incorrect Authorization

CVE-2021-26598—

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated atta

23RIESGO

abrir ↗

Nucleihigh

ImpressCMS < 1.4.3 - SQL Injection

CVE-2021-26599—

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.

43RIESGO

abrir ↗

Nucleimedium

EPrints 3.4.2 - Cross-Site Scripting

CVE-2021-26702—

EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.

18RIESGO

abrir ↗

Nucleimedium

Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting

CVE-2021-26710—

A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to

18RIESGO

abrir ↗

Nucleimedium

Jenzabar 9.2x-9.2.2 - Cross-Site Scripting

CVE-2021-26723—

Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS.

23RIESGO

abrir ↗

Nucleimedium

Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting

CVE-2021-26812—

Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This

40RIESGO

abrir ↗

Nucleicritical

Microsoft Exchange Server SSRF Vulnerability

CVE-2021-26855CRITICALbajo ataqueransomware

Microsoft Exchange Server Remote Code Execution Vulnerability

100RIESGO

abrir ↗

Nucleimedium

Odoo <= 15.0 - Cross-Site Scripting

CVE-2021-26947MEDIUM

Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote att

28RIESGO

abrir ↗

Nucleimedium

Doctor Appointment System 1.0 - SQL Injection

CVE-2021-27124—

SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated

18RIESGO

abrir ↗

Nucleicritical

Sercomm VD625 Smart Modems - CRLF Injection

CVE-2021-27132—

SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via

23RIESGO

abrir ↗

Nucleimedium

Clansphere CMS 2011.4 - Cross-Site Scripting

CVE-2021-27309—

Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter.

18RIESGO

abrir ↗

Nucleimedium

Clansphere CMS 2011.4 - Cross-Site Scripting

CVE-2021-27310—

Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter.

18RIESGO

abrir ↗

Nucleicritical

Doctor Appointment System 1.0 - SQL Injection

CVE-2021-27314—

SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL q

23RIESGO

abrir ↗

Nucleihigh

Doctor Appointment System 1.0 - SQL Injection

CVE-2021-27315—

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic

18RIESGO

abrir ↗

Nucleihigh

Doctor Appointment System 1.0 - SQL Injection

CVE-2021-27316—

Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malic

18RIESGO

abrir ↗

Nucleihigh

Doctor Appointment System 1.0 - SQL Injection

CVE-2021-27319—

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic

18RIESGO

abrir ↗

Nucleihigh

Doctor Appointment System 1.0 - SQL Injection

CVE-2021-27320—

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malic

18RIESGO

abrir ↗

Nucleimedium

Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting

CVE-2021-27330—

Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read

18RIESGO

abrir ↗

Nucleihigh

Grafana Unauthenticated Snapshot Creation

CVE-2021-27358—

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of

40RIESGO

abrir ↗

Nucleimedium

FUDForum 3.1.0 - Cross-Site Scripting

CVE-2021-27519—

A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "

38RIESGO

abrir ↗

Nucleimedium

FUDForum 3.1.0 - Cross-Site Scripting

CVE-2021-27520—

A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "

38RIESGO

abrir ↗

Nucleicritical

YeaLink DM 3.6.0.20 - Remote Command Injection

CVE-2021-27561CRITICALbajo ataque

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI,

95RIESGO

abrir ↗

Nucleicritical

Pega Infinity - Authentication Bypass

CVE-2021-27651CRITICAL

In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to byp

75RIESGO

abrir ↗

Nucleicritical

Appspace 6.2.4 - Server-Side Request Forgery

CVE-2021-27670—

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.

30RIESGO

abrir ↗

Nucleicritical

Apache Tapestry - Remote Code Execution

CVE-2021-27850—

Bypass of the fix for CVE-2019-0195

60RIESGO

abrir ↗

Nucleicritical

FatPipe WARP/IPVPN/MPVPN - Backdoor Account

CVE-2021-27856CRITICAL

FatPipe software administrative account with no password

43RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.