Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

4478 exploits

Nucleihigh

SkyWalking SQLI

CVE-2020-9483—

**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is

30RIESGO

abrir ↗

Nucleihigh

Apache Tomcat Remote Command Execution

CVE-2020-9484—

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)

30RIESGO

abrir ↗

Nucleimedium

Apache OFBiz 17.12.03 - Cross-Site Scripting

CVE-2020-9496—

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

60RIESGO

abrir ↗

Nucleicritical

FasterXML jackson-databind - Deserialization Remote Code Execution

CVE-2020-9547CRITICAL

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela

48RIESGO

abrir ↗

Nucleicritical

FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution

CVE-2020-9548CRITICAL

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela

48RIESGO

abrir ↗

Nucleicritical

Craft CMS < 3.3.0 - Server-Side Template Injection

CVE-2020-9757—

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed

40RIESGO

abrir ↗

Nucleicritical

Cisco Small Business RV Series - OS Command Injection

CVE-2021-1472MEDIUM

Cisco Small Business RV Series Routers Vulnerabilities

50RIESGO

abrir ↗

Nucleicritical

Cisco HyperFlex HX Data Platform - Remote Command Execution

CVE-2021-1497CRITICALbajo ataque

Cisco HyperFlex HX Command Injection Vulnerabilities

100RIESGO

abrir ↗

Nucleicritical

Cisco HyperFlex HX Data Platform - Remote Command Execution

CVE-2021-1498CRITICALbajo ataque

Cisco HyperFlex HX Command Injection Vulnerabilities

100RIESGO

abrir ↗

Nucleimedium

Cisco HyperFlex HX Data Platform - Arbitrary File Upload

CVE-2021-1499MEDIUM

Cisco HyperFlex HX Data Platform File Upload Vulnerability

50RIESGO

abrir ↗

Nucleicritical

SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation

CVE-2021-20021CRITICALbajo ataqueransomware

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account

100RIESGO

abrir ↗

Nucleimedium

SonicWall SonicOS 7.0 - Open Redirect

CVE-2021-20031—

A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management

43RIESGO

abrir ↗

Nucleicritical

SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution

CVE-2021-20038CRITICALbajo ataqueransomware

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows

100RIESGO

abrir ↗

Nucleihigh

Odoo Apps - Cross-Site Scripting via Prototype Pollution

CVE-2021-20086—

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a m

18RIESGO

abrir ↗

Nucleicritical

Buffalo WSR-2533DHPL2 - Path Traversal

CVE-2021-20090CRITICALbajo ataque

A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3

95RIESGO

abrir ↗

Nucleihigh

Buffalo WSR-2533DHPL2 - Configuration File Injection

CVE-2021-20091—

The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not pr

18RIESGO

abrir ↗

Nucleihigh

Buffalo WSR-2533DHPL2 - Improper Access Control

CVE-2021-20092—

The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not pr

18RIESGO

abrir ↗

Nucleihigh

TCExam <= 14.8.1 - Sensitive Information Exposure

CVE-2021-20114—

When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the

18RIESGO

abrir ↗

Nucleihigh

Draytek VigorConnect 1.6.0-B - Local File Inclusion

CVE-2021-20123HIGHbajo ataque

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the D

88RIESGO

abrir ↗

Nucleihigh

Draytek VigorConnect 6.0-B3 - Local File Inclusion

CVE-2021-20124HIGHbajo ataque

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the W

88RIESGO

abrir ↗

Nucleimedium

Gryphon Tower - Cross-Site Scripting

CVE-2021-20137—

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the

18RIESGO

abrir ↗

Nucleimedium

Trendnet AC2600 TEW-827DRU - Credentials Disclosure

CVE-2021-20150—

Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authe

30RIESGO

abrir ↗

Nucleimedium

Popup by Supsystic <1.10.5 - Cross-Site scripting

CVE-2021-24275—

Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)

43RIESGO

abrir ↗

Nucleimedium

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

CVE-2021-24276—

Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)

43RIESGO

abrir ↗

Nucleihigh

WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation

CVE-2021-24278—

Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation

18RIESGO

abrir ↗

Nucleicritical

WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload

CVE-2021-24284—

Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload

30RIESGO

abrir ↗

Nucleicritical

WordPress Car Seller - Auto Classifieds Script - SQL Injection

CVE-2021-24285—

Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection

23RIESGO

abrir ↗

Nucleimedium

WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting

CVE-2021-24286—

Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)

43RIESGO

abrir ↗

Nucleimedium

WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

CVE-2021-24287—

Select All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS)

43RIESGO

abrir ↗

Nucleimedium

WordPress AcyMailing <7.5.0 - Open Redirect

CVE-2021-24288—

AcyMailing < 7.5.0 - Unauthenticated Open Redirect

18RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.