Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.655exploits catalogados

39.248CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.347Exploit-DB 24.485GitHub PoC 16.178VulnCheck XDB 9644Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

4478 exploits

Nucleimedium

FatPipe WARP/IPVPN/MPVPN - Authorization Bypass

CVE-2021-27858MEDIUM

Missing authorization vulnerability in FatPipe software

28RIESGO

abrir ↗

Nucleicritical

Apache Solr <=8.8.1 - Server-Side Request Forgery

CVE-2021-27905—

SSRF vulnerability with the Replication handler

40RIESGO

abrir ↗

Nucleimedium

Mautic <3.3.4 - Cross-Site Scripting

CVE-2021-27909MEDIUM

XSS vulnerability on password reset page

28RIESGO

abrir ↗

Nucleicritical

LumisXP <10.0.0 - Blind XML External Entity Attack

CVE-2021-27931—

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControl

23RIESGO

abrir ↗

Nucleicritical

SonLogger - Arbitrary File Upload

CVE-2021-27964—

SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Con

50RIESGO

abrir ↗

Nucleimedium

Hongdian H8922 3.0.5 Devices - Local File Inclusion

CVE-2021-28149—

Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user

23RIESGO

abrir ↗

Nucleimedium

Hongdian H8922 3.0.5 - Information Disclosure

CVE-2021-28150—

Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and oth

18RIESGO

abrir ↗

Nucleihigh

Hongdian H8922 3.0.5 - Remote Command Injection

CVE-2021-28151—

Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) f

23RIESGO

abrir ↗

Nucleimedium

Eclipse Jetty - Information Disclosure

CVE-2021-28164MEDIUM

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai

70RIESGO

abrir ↗

Nucleimedium

Eclipse Jetty ConcatServlet - Information Disclosure

CVE-2021-28169MEDIUM

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doub

50RIESGO

abrir ↗

Nucleimedium

Joomla! ChronoForums 2.0.11 - Local File Inclusion

CVE-2021-28377—

ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.

18RIESGO

abrir ↗

Nucleicritical

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

CVE-2021-28480CRITICAL

Microsoft Exchange Server Remote Code Execution Vulnerability

85RIESGO

abrir ↗

Nucleicritical

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

CVE-2021-28481CRITICAL

Microsoft Exchange Server Remote Code Execution Vulnerability

55RIESGO

abrir ↗

Nucleicritical

QNAP HBS 3 - Broken Access Control

CVE-2021-28799CRITICALbajo ataqueransomware

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

95RIESGO

abrir ↗

Nucleicritical

Netmask NPM Package - Server-Side Request Forgery

CVE-2021-28918—

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attacke

23RIESGO

abrir ↗

Nucleihigh

Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure

CVE-2021-28937—

The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) conta

18RIESGO

abrir ↗

Nucleimedium

rConfig 3.9.6 - Local File Inclusion

CVE-2021-29006—

rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any

18RIESGO

abrir ↗

Nucleihigh

LDAP Injection In OpenAM

CVE-2021-29156—

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacke

60RIESGO

abrir ↗

Nucleicritical

Apache OFBiz < 17.12.07 - Arbitrary Code Execution

CVE-2021-29200—

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

30RIESGO

abrir ↗

Nucleicritical

HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass

CVE-2021-29203—

A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infr

30RIESGO

abrir ↗

Nucleicritical

Nacos <1.4.1 - Authentication Bypass

CVE-2021-29441HIGH

Authentication bypass

78RIESGO

abrir ↗

Nucleihigh

Nacos <1.4.1 - Authentication Bypass

CVE-2021-29442HIGH

Authentication bypass

68RIESGO

abrir ↗

Nucleimedium

Ghost CMS <=4.32 - Cross-Site Scripting

CVE-2021-29484MEDIUM

DOM XSS in Theme Preview

28RIESGO

abrir ↗

Nucleimedium

Jellyfin 10.7.2 - Server Side Request Forgery

CVE-2021-29490MEDIUM

Unauthenticated GET requests through Remote Image endpoints

40RIESGO

abrir ↗

Nucleihigh

XStream <1.4.17 - Remote Code Execution

CVE-2021-29505HIGH

XStream is vulnerable to a Remote Command Execution attack

58RIESGO

abrir ↗

Nucleimedium

Prometheus - Open Redirect

CVE-2021-29622MEDIUM

Arbitrary redirects under /new endpoint

33RIESGO

abrir ↗

Nucleimedium

Adminer <=4.8.0 - Cross-Site Scripting

CVE-2021-29625HIGH

XSS in doc_link

36RIESGO

abrir ↗

Nucleimedium

Seo Panel 4.8.0 - Cross-Site Scripting

CVE-2021-3002—

Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.

18RIESGO

abrir ↗

Nucleimedium

SysAid Technologies 20.3.64 b14 - Cross-Site Scripting

CVE-2021-30049—

SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.

18RIESGO

abrir ↗

Nucleicritical

Laminas Project laminas-http - Remote Code Execution

CVE-2021-3007—

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead

60RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.