Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

4478 exploits

Nucleimedium

WordPress White Label CMS <2.2.9 - Cross-Site Scripting

CVE-2022-0422—

White Label MS < 2.2.9 - Reflected Cross-Site Scripting

18RIESGO

abrir ↗

Nucleimedium

Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure

CVE-2022-0424—

Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure

18RIESGO

abrir ↗

Nucleimedium

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting

CVE-2022-0429—

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting

18RIESGO

abrir ↗

Nucleimedium

Mastodon Prototype Pollution Vulnerability

CVE-2022-0432HIGH

Prototype Pollution in mastodon/mastodon

36RIESGO

abrir ↗

Nucleicritical

WordPress Page Views Count <2.4.15 - SQL Injection

CVE-2022-0434—

Page Views Count < 2.4.15 - Unauthenticated SQL Injection

23RIESGO

abrir ↗

Nucleimedium

karma-runner DOM-based Cross-Site Scripting

CVE-2022-0437MEDIUM

Cross-site Scripting (XSS) - DOM in karma-runner/karma

33RIESGO

abrir ↗

Nucleihigh

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

CVE-2022-0439—

Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection

18RIESGO

abrir ↗

Nucleicritical

MasterStudy LMS <2.7.6 - Improper Access Control

CVE-2022-0441—

MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation

60RIESGO

abrir ↗

Nucleicritical

Popup Builder Plugin - SQL Injection and Cross-Site Scripting

CVE-2022-0479—

Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting

30RIESGO

abrir ↗

Nucleicritical

Easy!Appointments <1.4.3 - Broken Access Control

CVE-2022-0482CRITICAL

Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

75RIESGO

abrir ↗

Nucleimedium

Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting

CVE-2022-0533—

Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress E2Pdf <1.16.45 - Cross-Site Scripting

CVE-2022-0535—

E2Pdf < 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleicritical

Atlassian Jira Seraph - Authentication Bypass

CVE-2022-0540CRITICAL

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially

85RIESGO

abrir ↗

Nucleicritical

Formcraft3 <3.8.28 - Server-Side Request Forgery

CVE-2022-0591—

Formcraft3 < 3.8.28 - Unauthenticated SSRF

43RIESGO

abrir ↗

Nucleicritical

MapSVG < 6.2.20 - Unauthenticated SQLi

CVE-2022-0592—

MapSVG < 6.2.20 - Unauthenticated SQLi

23RIESGO

abrir ↗

Nucleimedium

WordPress Shareaholic <9.7.6 - Information Disclosure

CVE-2022-0594—

Shareaholic < 9.7.6 - Information Disclosure

18RIESGO

abrir ↗

Nucleimedium

WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting

CVE-2022-0595—

Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS

23RIESGO

abrir ↗

Nucleimedium

Microweber < 1.2.11 - Open Redirection

CVE-2022-0597MEDIUM

Open Redirect in microweber/microweber

28RIESGO

abrir ↗

Nucleimedium

WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting

CVE-2022-0599—

Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting

18RIESGO

abrir ↗

Nucleihigh

WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

CVE-2022-0651CRITICAL

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type

55RIESGO

abrir ↗

Nucleimedium

Wordpress Profile Builder Plugin Cross-Site Scripting

CVE-2022-0653MEDIUM

Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting

28RIESGO

abrir ↗

Nucleihigh

uDraw <3.3.3 - Local File Inclusion

CVE-2022-0656—

uDraw < 3.3.3 - Unauthenticated Arbitrary File Access

18RIESGO

abrir ↗

Nucleicritical

CommonsBooking < 2.6.8 - SQL Injection

CVE-2022-0658—

CommonsBooking < 2.6.8 - Unauthenticated SQL Injection

18RIESGO

abrir ↗

Nucleihigh

Microweber <1.2.11 - Information Disclosure

CVE-2022-0660CRITICAL

Generation of Error Message Containing Sensitive Information in microweber/microweber

43RIESGO

abrir ↗

Nucleihigh

Microweber < 1.2.11 - CRLF Injection

CVE-2022-0666HIGH

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber

48RIESGO

abrir ↗

Nucleimedium

Microweber <1.2.11 - Cross-Site Scripting

CVE-2022-0678MEDIUM

Cross-site Scripting (XSS) - Reflected in microweber/microweber

28RIESGO

abrir ↗

Nucleicritical

WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion

CVE-2022-0679—

Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE

30RIESGO

abrir ↗

Nucleimedium

Rudloff alltube prior to 3.0.1 - Open Redirect

CVE-2022-0692MEDIUM

Open Redirect on Rudloff/alltube in rudloff/alltube

28RIESGO

abrir ↗

Nucleicritical

WordPress Master Elements <=8.0 - SQL Injection

CVE-2022-0693—

Master Elements <= 8.0 - Unauthenticated SQLi

18RIESGO

abrir ↗

Nucleicritical

GitLab CE/EE - Information Disclosure

CVE-2022-0735CRITICAL

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star

48RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.