Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.780exploits catalogados
39.319CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
4478 exploits
Nucleicritical
Ivanti Avalanche - Remote Code Execution
CVE-2023-32563HIGH
An unauthenticated attacker could achieve the code execution through a RemoteControl server.
58RIESGO
abrir ↗
Nucleicritical
Subscribe to Category <= 2.7.4 - SQL Injection
CVE-2023-32590CRITICAL
WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection
63RIESGO
abrir ↗
Nucleicritical
MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
CVE-2023-3277CRITICAL
MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
43RIESGO
abrir ↗
Nucleicritical
Emby Server - Authentication Bypass
CVE-2023-33193CRITICAL
Emby Server Proxy Header Spoofing Vulnerability
43RIESGO
abrir ↗
Nucleicritical
Old Age Home Management System v1.0 - SQL Injection
CVE-2023-33338CRITICAL
Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.
43RIESGO
abrir ↗
Nucleimedium
BlogEngine CMS - Open Redirect
CVE-2023-33405MEDIUM
Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.
40RIESGO
abrir ↗
Nucleihigh
Faculty Evaluation System v1.0 - SQL Injection
CVE-2023-33439HIGH
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.
36RIESGO
abrir ↗
Nucleihigh
Faculty Evaluation System v1.0 - Remote Code Execution
CVE-2023-33440HIGH
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_u
61RIESGO
abrir ↗
Nucleicritical
HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation
CVE-2023-37999CRITICAL
WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability
43RIESGO
abrir ↗
Nucleicritical
Ivanti Sentry - Authentication Bypass
CVE-2023-38035CRITICALbajo ataqueransomware
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an
100RIESGO
abrir ↗
Nucleimedium
Revive Adserver 5.4.1 - Cross-Site Scripting
CVE-2023-38040—
A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..
18RIESGO
abrir ↗
Nucleimedium
SuperWebMailer 9.00.0.01710 - Cross-Site Scripting
CVE-2023-38192—
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwor
18RIESGO
abrir ↗
Nucleimedium
SuperWebMailer - Cross-Site Scripting
CVE-2023-38194—
An issue was discovered in SuperWebMailer 9.00.0.01710. It allows keepalive.php XSS via a GET parameter.
18RIESGO
abrir ↗
Nucleicritical
Adobe ColdFusion - Deserialization of Untrusted Data
CVE-2023-38203CRITICALbajo ataqueransomware
Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE
95RIESGO
abrir ↗
Nucleihigh
Adobe ColdFusion - Access Control Bypass
CVE-2023-38205HIGHbajo ataque
ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
88RIESGO
abrir ↗
Nucleicritical
Dahua Smart Park Management - Arbitrary File Upload
CVE-2023-3836MEDIUM
Dahua Smart Park Management unrestricted upload
70RIESGO
abrir ↗
Nucleimedium
mooDating 1.2 - Cross-site scripting
CVE-2023-3843LOW
mooSocial mooDating URL question cross site scripting
43RIESGO
abrir ↗
Nucleihigh
Fujitsu IP Series - Hardcoded Credentials
CVE-2023-38433—
Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticat
18RIESGO
abrir ↗
Nucleimedium
MooDating 1.2 - Cross-Site Scripting
CVE-2023-3844LOW
mooSocial mooDating URL friends cross site scripting
43RIESGO
abrir ↗
Nucleimedium
MooDating 1.2 - Cross-Site Scripting
CVE-2023-3845LOW
mooSocial mooDating URL ajax_invite cross site scripting
43RIESGO
abrir ↗
Nucleimedium
MooDating 1.2 - Cross-Site Scripting
CVE-2023-3846LOW
mooSocial mooDating URL pages cross site scripting
43RIESGO
abrir ↗
Nucleimedium
MooDating 1.2 - Cross-Site scripting
CVE-2023-3847LOW
mooSocial mooDating URL users cross site scripting
43RIESGO
abrir ↗
Nucleimedium
MooDating 1.2 - Cross-site scripting
CVE-2023-3848LOW
mooSocial mooDating URL view cross site scripting
43RIESGO
abrir ↗
Nucleimedium
mooDating 1.2 - Cross-site scripting
CVE-2023-3849LOW
mooSocial mooDating URL find-a-match cross site scripting
43RIESGO
abrir ↗
Nucleimedium
CopyParty v1.8.6 - Cross Site Scripting
CVE-2023-38501MEDIUM
copyparty vulnerable to reflected cross-site scripting via k304 parameter
48RIESGO
abrir ↗
Nucleicritical
Metabase < 0.46.6.1 - Remote Code Execution
CVE-2023-38646—
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
60RIESGO
abrir ↗
Nucleimedium
PHP Login System 2.0.1 - Cross-Site Scripting
CVE-2023-38875—
A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to ex
18RIESGO
abrir ↗
Nucleihigh
openSIS v9.0 - Path Traversal
CVE-2023-38879—
The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a direc
18RIESGO
abrir ↗
Nucleihigh
ZKTeco BioTime v8.5.5 - Path Traversal
CVE-2023-38950HIGHbajo ataque
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbit
100RIESGO
abrir ↗
Nucleihigh
ZKTeco BioTime <= 9.0.1 - Privilege Escalation
CVE-2023-38952HIGH
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due
36RIESGO
abrir ↗
← anteriorpágina 84 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.