Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.180exploits catalogados

31.691CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.469Referência 19.841GitHub PoC 13.140VulnCheck XDB 8078Nuclei 4190Metasploit 3462✓ solo verificadosrecientes populares riesgo

4190 exploits

Nucleimedium

WP Finance Plugin <= 1.3.6 - Cross-Site Scripting

CVE-2024-13097MEDIUM

WP Finance <= 1.3.6 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

WordPress Email Newsletter - Reflected XSS

CVE-2024-13098MEDIUM

WP Email Newsletter <= 1.1 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

Widget4Call WordPress - Cross-Site Scripting

CVE-2024-13099MEDIUM

Widget4call <= 1.0.7 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

WP MediaTagger <= 4.1.1 - Cross-Site Scripting

CVE-2024-13112MEDIUM

WP MediaTagger <= 4.1.1 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

WP Projects Portfolio <= 3.0 - Cross-Site Scripting

CVE-2024-13114MEDIUM

WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure

CVE-2024-13126MEDIUM

Download Manager < 3.3.07 - Unauthenticated Data Exposure

28RIESGO

abrir ↗

Nucleicritical

Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursive

CVE-2024-13159CRITICALbajo ataque

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up

100RIESGO

abrir ↗

Nucleicritical

Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard

CVE-2024-13160CRITICALbajo ataque

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up

100RIESGO

abrir ↗

Nucleicritical

Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile

CVE-2024-13161CRITICALbajo ataque

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up

100RIESGO

abrir ↗

Nucleimedium

CVE-2024-13219MEDIUM

Policy Genius <= 2.0.4 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

WordPress Google Map Professional - Cross-Site Scripting

CVE-2024-13220MEDIUM

Google Map Professional <= 1.0 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting

CVE-2024-13221MEDIUM

Fantastic Elasticsearch <= 4.1.0 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

WordPress User Messages <= 1.2.4 - Reflected XSS

CVE-2024-13222MEDIUM

User Messages <= 1.2.4 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

SlideDeck 1 Lite Content Slider - Cross-Site Scripting

CVE-2024-13224MEDIUM

SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSS

28RIESGO

abrir ↗

Nucleihigh

Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials

CVE-2024-20440HIGH

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive inf

48RIESGO

abrir ↗

Nucleihigh

Artica Proxy - Unauthenticated LFI

CVE-2024-2053HIGH

Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability

68RIESGO

abrir ↗

Nucleihigh

Adobe ColdFusion - Arbitrary File Read

CVE-2024-20767HIGHbajo ataque

ColdFusion | Improper Access Control (CWE-284)

100RIESGO

abrir ↗

Nucleihigh

Oracle Retail Xstore Suite - Pre-authenticated Path Traversal

CVE-2024-21136HIGH

Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). Supported

36RIESGO

abrir ↗

Nucleimedium

Dash Framework - Cross-site Scripting

CVE-2024-21485MEDIUM

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; v

28RIESGO

abrir ↗

Nucleihigh

MobSF - Path Traversal

CVE-2024-21633HIGH

Arbitrary file write on Decoding

36RIESGO

abrir ↗

Nucleimedium

Flarum < 1.8.5 - Open Redirect

CVE-2024-21641MEDIUM

Flarum's Logout Route allows open redirects

28RIESGO

abrir ↗

Nucleihigh

pyLoad Flask Config - Access Control

CVE-2024-21644HIGH

pyLoad unauthenticated flask configuration leakage

48RIESGO

abrir ↗

Nucleimedium

pyload - Log Injection

CVE-2024-21645MEDIUM

pyLoad Log Injection

33RIESGO

abrir ↗

Nucleicritical

XWiki < 4.10.20 - Remote code execution

CVE-2024-21650CRITICAL

XWiki Remote Code Execution vulnerability via user registration

65RIESGO

abrir ↗

Nucleihigh

Atlassian Confluence Data Center and Server - Remote Code Execution

CVE-2024-21683HIGH

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and

78RIESGO

abrir ↗

Nucleicritical

Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection

CVE-2024-21887CRITICALbajo ataqueransomware

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,

100RIESGO

abrir ↗

Nucleihigh

Ivanti SAML - Server Side Request Forgery (SSRF)

CVE-2024-21893HIGHbajo ataqueransomware

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy

100RIESGO

abrir ↗

Nucleihigh

Ivanti Connect Secure - XXE

CVE-2024-22024HIGH

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Se

78RIESGO

abrir ↗

Nucleimedium

Fastify Swagger-UI - Information Disclosure

CVE-2024-22207MEDIUM

Default swagger-ui configuration exposes all files in the module

28RIESGO

abrir ↗

Nucleicritical

IBM Operational Decision Manager - JNDI Injection

CVE-2024-22319HIGH

IBM Operational Decision Manager JDNI injection

58RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.