Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
4478 exploits
Nucleicritical
PrestaShop AP Pagebuilder <= 2.4.4 - SQL Injection
CVE-2022-22897—
A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder
23RIESGO
abrir ↗
Nucleimedium
Trilium <0.52.4 - Cross-Site Scripting
CVE-2022-2290MEDIUM
Cross-site Scripting (XSS) - Reflected in zadam/trilium
28RIESGO
abrir ↗
Nucleicritical
Spring Cloud Gateway Code Injection
CVE-2022-22947CRITICALbajo ataque
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RIESGO
abrir ↗
Nucleicritical
VMware Workspace ONE Access - Server-Side Template Injection
CVE-2022-22954CRITICALbajo ataqueransomware
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
100RIESGO
abrir ↗
Nucleicritical
VMware Workspace ONE Access - Authentication Bypass
CVE-2022-22956—
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth
30RIESGO
abrir ↗
Nucleicritical
Spring Cloud - Remote Code Execution
CVE-2022-22963CRITICALbajo ataque
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RIESGO
abrir ↗
Nucleimedium
ManageEngine ADSelfService Plus <6121 - Stored Cross-Site Scripting
CVE-2022-24681—
Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock
18RIESGO
abrir ↗
Nucleimedium
Zimbra Collaboration Suite < 8.8.15 - Improper Encoding
CVE-2022-24682MEDIUMbajo ataqueransomware
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), a
70RIESGO
abrir ↗
Nucleihigh
Icinga Web 2 - Arbitrary File Disclosure
CVE-2022-24716HIGH
Path traversal in Icinga Web 2
78RIESGO
abrir ↗
Nucleicritical
GeoServer <1.2.2 - Remote Code Execution
CVE-2022-24816CRITICALbajo ataque
Improper Control of Generation of Code in jai-ext
100RIESGO
abrir ↗
Nucleimedium
XWiki < 12.10.11, 13.4.4 & 13.9-rc-1 - Information Disclosure
CVE-2022-24819MEDIUM
Unauthenticated user can retrieve the list of users through uorgsuggest.vm
28RIESGO
abrir ↗
Nucleihigh
Flyte Console <0.52.0 - Server-Side Request Forgery
CVE-2022-24856CRITICAL
Server-Side Request Forgery in FlyteConsole
48RIESGO
abrir ↗
Nucleicritical
Wavlink WN535K2/WN535K3 - OS Command Injection
CVE-2022-2486HIGH
WAVLINK WN535K2/WN535K3 os command injection
48RIESGO
abrir ↗
Nucleicritical
Wavlink WN535K2/WN535K3 - OS Command Injection
CVE-2022-2487HIGH
WAVLINK WN535K2/WN535K3 nightled.cgi os command injection
58RIESGO
abrir ↗
Nucleicritical
Wavlink WN535K2/WN535K3 - OS Command Injection
CVE-2022-2488HIGH
WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injection
48RIESGO
abrir ↗
Nucleimedium
Contao <4.13.3 - Cross-Site Scripting
CVE-2022-24899HIGH
Cross site scripting via canonical tag
36RIESGO
abrir ↗
Nucleihigh
Piano LED Visualizer 1.3 - Local File Inclusion
CVE-2022-24900CRITICAL
Absolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizer
43RIESGO
abrir ↗
Nucleihigh
TerraMaster TOS < 4.2.30 Server Information Disclosure
CVE-2022-24990CRITICALbajo ataqueransomware
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agen
100RIESGO
abrir ↗
Nucleicritical
TP-Link TL-WR840N - Command Injection
CVE-2022-25061—
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_set
30RIESGO
abrir ↗
Nucleicritical
TOTOLink - Unauthenticated Command Injection
CVE-2022-25082—
TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerab
23RIESGO
abrir ↗
Nucleicritical
MCMS 5.2.4 - SQL Injection
CVE-2022-25125—
MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.
18RIESGO
abrir ↗
Nucleicritical
WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
CVE-2022-25148CRITICAL
WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id
85RIESGO
abrir ↗
Nucleihigh
WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
CVE-2022-25149CRITICAL
WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP
65RIESGO
abrir ↗
Nucleihigh
DVDFab 12 Player/PlayerFab - Local File Inclusion
CVE-2022-25216—
An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for wh
23RIESGO
abrir ↗
Nucleicritical
ThinVNC - Authentication Bypass
CVE-2022-25226—
ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?
23RIESGO
abrir ↗
Nucleicritical
Bonita Web 2021.2 - Authentication/Authorization Bypass
CVE-2022-25237—
Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude patt
30RIESGO
abrir ↗
Nucleicritical
ZEROF Web Server 2.0 - SQL Injection
CVE-2022-25322—
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.
18RIESGO
abrir ↗
Nucleimedium
ZEROF Web Server 2.0 - Cross-Site Scripting
CVE-2022-25323—
ZEROF Web Server 2.0 allows /admin.back XSS.
18RIESGO
abrir ↗
Nucleimedium
SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure
CVE-2022-2535—
SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure
18RIESGO
abrir ↗
Nucleimedium
Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection
CVE-2022-25356MEDIUM
Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection.
28RIESGO
abrir ↗
← anteriorpágina 90 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.