Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
4478 exploits
Nucleimedium
Ametys CMS Information Disclosure
CVE-2022-26159—
The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as
23RIESGO
abrir ↗
Nucleihigh
Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion
CVE-2022-26233—
Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allow
23RIESGO
abrir ↗
Nucleimedium
Yonyou U8 13.0 - Cross-Site Scripting
CVE-2022-26263—
Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/W
30RIESGO
abrir ↗
Nucleimedium
WordPress Newspaper < 12 - Cross-Site Scripting
CVE-2022-2627MEDIUM
Newspaper < 12 - Reflected Cross-Site Scripting
28RIESGO
abrir ↗
Nucleihigh
74cmsSE v3.4.1 - Arbitrary File Read
CVE-2022-26271—
74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controlle
18RIESGO
abrir ↗
Nucleihigh
All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery
CVE-2022-2633HIGH
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side reques
48RIESGO
abrir ↗
Nucleicritical
DotCMS - Arbitrary File Upload
CVE-2022-26352CRITICALbajo ataqueransomware
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form req
100RIESGO
abrir ↗
Nucleimedium
HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting
CVE-2022-26564—
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 p
18RIESGO
abrir ↗
Nucleicritical
Mingsoft MCMS v5.2.7 - SQL Injection
CVE-2022-26585—
Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
18RIESGO
abrir ↗
Nucleicritical
Open Automation Software OAS Platform V16.00.0121 - Missing Authentication
CVE-2022-26833CRITICAL
An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V
55RIESGO
abrir ↗
Nucleicritical
elFinder <=2.1.60 - Local File Inclusion
CVE-2022-26960—
connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote
30RIESGO
abrir ↗
Nucleihigh
Yearning - Directory Traversal
CVE-2022-27043—
Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal.
18RIESGO
abrir ↗
Nucleicritical
Bitrix Site Manager - Remote Code Execution
CVE-2022-27228—
In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can ex
23RIESGO
abrir ↗
Nucleimedium
Openemr < 7.0.0.1 - Cross-Site Scripting
CVE-2022-2733CRITICAL
Cross-site Scripting (XSS) - Reflected in openemr/openemr
65RIESGO
abrir ↗
Nucleimedium
Kavita <0.5.4.1 - Server-Side Request Forgery
CVE-2022-2756HIGH
Server-Side Request Forgery (SSRF) in kareadita/kavita
36RIESGO
abrir ↗
Nucleicritical
QNAP QTS Photo Station External Reference - Local File Inclusion
CVE-2022-27593CRITICALbajo ataqueransomware
DeadBolt Ransomware
95RIESGO
abrir ↗
Nucleihigh
WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability
CVE-2022-27849MEDIUM
WordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerability
28RIESGO
abrir ↗
Nucleihigh
Zimbra Collaboration Suite - Memcached Command Injection
CVE-2022-27924CRITICALbajo ataqueransomware
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands i
95RIESGO
abrir ↗
Nucleihigh
Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal
CVE-2022-27925HIGHbajo ataqueransomware
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file
100RIESGO
abrir ↗
Nucleimedium
Zimbra Collaboration (ZCS) - Cross Site Scripting
CVE-2022-27926MEDIUMbajo ataque
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboratio
63RIESGO
abrir ↗
Nucleicritical
Microfinance Management System 1.0 - SQL Injection
CVE-2022-27927—
A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application d
23RIESGO
abrir ↗
Nucleicritical
Cuppa CMS v1.0 - SQL injection
CVE-2022-27984—
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/te
18RIESGO
abrir ↗
Nucleicritical
Cuppa CMS v1.0 - SQL injection
CVE-2022-27985—
CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.
18RIESGO
abrir ↗
Nucleicritical
Atom CMS v2.0 - SQL Injection
CVE-2022-28032—
AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php
18RIESGO
abrir ↗
Nucleicritical
Atom.CMS 2.0 - SQL Injection
CVE-2022-28033—
Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php
18RIESGO
abrir ↗
Nucleihigh
College Management System 1.0 - SQL Injection
CVE-2022-28079—
College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.
43RIESGO
abrir ↗
Nucleihigh
Royal Event - SQL Injection
CVE-2022-28080—
Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.
50RIESGO
abrir ↗
Nucleicritical
Selenium Grid < 4.0.0-alpha-7 - Remote Code Execution
CVE-2022-28108—
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-url
23RIESGO
abrir ↗
Nucleimedium
Navigate CMS 2.9.4 - Server-Side Request Forgery
CVE-2022-28117—
A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the ap
43RIESGO
abrir ↗
Nucleicritical
Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution
CVE-2022-28219—
Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote
60RIESGO
abrir ↗
← anteriorpágina 93 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.