Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.554exploits catalogados
39.165CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.281Exploit-DB 24.485GitHub PoC 16.153VulnCheck XDB 9636Nuclei 4476Metasploit 3523✓ solo verificadosrecientespopularesriesgo
3523 exploits
Metasploit300
OneDev Unauthenticated Arbitrary File Read
OneDev vulnerable to arbitrary file reading for unauthenticated user
41RIESGO
abrir ↗Metasploit600
Grafana SQL Expressions DuckDB Command Injection
Grafana SQL Expressions allow for remote code execution
85RIESGO
abrir ↗Metasploit600
Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)
Expedition: Missing Authentication Leads to Admin Account Takeover
100RIESGO
abrir ↗Metasploit600
Palo Alto Expedition Remote Code Execution (CVE-2024-5910 and CVE-2024-9464)
Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type
48RIESGO
abrir ↗Metasploit600
Ivanti Connect Secure Authenticated Remote Code Execution via OpenSSL CRLF Injection
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Se
65RIESGO
abrir ↗Metasploit300
CUPS IPP Attributes LAN Remote Code Execution
libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server
58RIESGO
abrir ↗Metasploit300
CUPS IPP Attributes LAN Remote Code Execution
libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer
48RIESGO
abrir ↗Metasploit300
CUPS IPP Attributes LAN Remote Code Execution
cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source
60RIESGO
abrir ↗Metasploit300
WordPress TI WooCommerce Wishlist SQL Injection (CVE-2024-43917)
WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability
68RIESGO
abrir ↗Metasploit600
dizqueTV Unauthenticated Remote Code Execution
dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path
43RIESGO
abrir ↗Metasploit300
WordPress LearnPress Unauthenticated SQLi (CVE-2024-8522, CVE-2024-8529)
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
75RIESGO
abrir ↗Metasploit300
WordPress LearnPress Unauthenticated SQLi (CVE-2024-8522, CVE-2024-8529)
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
68RIESGO
abrir ↗Metasploit600
VICIdial Authenticated Remote Code Execution
VICIdial Authenticated Remote Code Execution
58RIESGO
abrir ↗Metasploit300
Vicidial SQL Injection Time-based Admin Credentials Enumeration
VICIdial Unauthenticated SQL Injection
85RIESGO
abrir ↗Metasploit600
SPIP BigUp Plugin Unauthenticated RCE
SPIP Bigup Multipart File Upload OS Command Injection
85RIESGO
abrir ↗Metasploit600
Wordpress LiteSpeed Cache plugin cookie theft
WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability
85RIESGO
abrir ↗Metasploit300
WhatsUp Gold SQL Injection (CVE-2024-6670)
WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability
100RIESGO
abrir ↗Metasploit600
Moodle Remote Code Execution (CVE-2024-43425)
Moodle: remote code execution via calculated question types
78RIESGO
abrir ↗Metasploit600
GiveWP Unauthenticated Donation Process Exploit
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
68RIESGO
abrir ↗Metasploit600
GiveWP Unauthenticated Donation Process Exploit
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
85RIESGO
abrir ↗Metasploit600
Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)
Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type
48RIESGO
abrir ↗Metasploit600
Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)
Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution
48RIESGO
abrir ↗Metasploit300
SolarWinds Web Help Desk Backdoor (CVE-2024-28987)
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
100RIESGO
abrir ↗Metasploit600
SPIP Unauthenticated RCE via porte_plume Plugin
SPIP porte_plume Plugin Arbitrary PHP Execution
85RIESGO
abrir ↗Metasploit600
BYOB Unauthenticated RCE via Arbitrary File Write and Command Injection (CVE-2024-45256, CVE-2024-45257)
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
36RIESGO
abrir ↗Metasploit600
BYOB Unauthenticated RCE via Arbitrary File Write and Command Injection (CVE-2024-45256, CVE-2024-45257)
An arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overw
43RIESGO
abrir ↗Metasploit300
Camaleon CMS Directory Traversal CVE-2024-46987
Arbitrary path traversal in Camaleon CMS
61RIESGO
abrir ↗Metasploit500
Asterisk AMI Originate Authenticated RCE
Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan
36RIESGO
abrir ↗Metasploit300
Ivanti Virtual Traffic Manager Authentication Bypass (CVE-2024-7593)
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.