Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
4478 exploits
Nucleimedium
Pretty Url <= 1.5.4 - Cross-Site Scripting
CVE-2023-2009MEDIUM
Pretty Url <= 1.5.4 - Admin+ Stored XSS in plugin settings
28RIESGO
abrir ↗
Nucleicritical
Cisco IOS XE Web UI - Command Injection
CVE-2023-20198CRITICALbajo ataque
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS
100RIESGO
abrir ↗
Nucleimedium
Custom 404 Pro < 3.7.3 - Cross-Site Scripting
CVE-2023-2023MEDIUM
Custom 404 Pro < 3.7.3 - Reflected Cross-Site Scripting
28RIESGO
abrir ↗
Nucleimedium
DedeCMS 5.7.87 - Directory Traversal
CVE-2023-2059MEDIUM
DedeCMS select_templets.php path traversal
28RIESGO
abrir ↗
Nucleicritical
VMware Aria Operations for Logs - Unauthenticated Remote Code Execution
CVE-2023-20864CRITICAL
VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with netwo
65RIESGO
abrir ↗
Nucleicritical
VMware VRealize Network Insight - Remote Code Execution
CVE-2023-20887CRITICALbajo ataque
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware
100RIESGO
abrir ↗
Nucleihigh
VMware Aria Operations for Networks - Remote Code Execution
CVE-2023-20888HIGH
Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network acc
58RIESGO
abrir ↗
Nucleihigh
VMware Aria Operations for Networks - Code Injection Information Disclosure Vulnerability
CVE-2023-20889HIGH
Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to
58RIESGO
abrir ↗
Nucleimedium
Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting
CVE-2023-2122—
Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting
18RIESGO
abrir ↗
Nucleicritical
Purchase Order Management v1.0 - SQL Injection
CVE-2023-2130MEDIUM
SourceCodester Purchase Order Management System GET Parameter view_details.php sql injection
28RIESGO
abrir ↗
Nucleimedium
Aajoda Testimonials < 2.2.2 - Cross-Site Scripting
CVE-2023-2178—
Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS
18RIESGO
abrir ↗
Nucleihigh
Oracle Peoplesoft - Unauthenticated File Read
CVE-2023-22047HIGH
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers
58RIESGO
abrir ↗
Nucleimedium
Adobe Connect < 12.1.5 - Local File Disclosure
CVE-2023-22232MEDIUM
Adobe Connect Improper Access Control Security feature bypass
70RIESGO
abrir ↗
Nucleimedium
Seo By 10Web < 1.2.7 - Cross-Site Scripting
CVE-2023-2224MEDIUM
Seo By 10Web < 1.2.7 - Admin+ Stored XSS
28RIESGO
abrir ↗
Nucleimedium
Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)
CVE-2023-30019MEDIUM
imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL para
28RIESGO
abrir ↗
Nucleicritical
PrestaShop leocustomajax 1.0 & 1.0.0 - SQL Injection
CVE-2023-30150CRITICAL
PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php.
43RIESGO
abrir ↗
Nucleicritical
PrestaShop 'possearchproducts' <= 1.7 - SQL Injection
CVE-2023-30192CRITICAL
Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find().
43RIESGO
abrir ↗
Nucleicritical
Prestashop posstaticfooter <= 1.0.0 - SQL Injection
CVE-2023-30194CRITICAL
Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
55RIESGO
abrir ↗
Nucleimedium
OURPHP <= 7.2.0 - Cross Site Scripting
CVE-2023-30210MEDIUM
OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.
28RIESGO
abrir ↗
Nucleimedium
OURPHP <= 7.2.0 - Cross Site Scripting
CVE-2023-30212MEDIUM
OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.
28RIESGO
abrir ↗
Nucleimedium
Webkul QloApps 1.5.2 - Cross-site Scripting
CVE-2023-30256MEDIUM
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informat
48RIESGO
abrir ↗
Nucleicritical
MagnusBilling - Remote Code Execution
CVE-2023-30258CRITICAL
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com
85RIESGO
abrir ↗
Nucleimedium
Cacti < 1.2.25 Insecure Deserialization
CVE-2023-30534MEDIUM
Insecure Deserialization in Cacti
28RIESGO
abrir ↗
Nucleihigh
Rudder Server < 1.3.0-rc.1 - SQL Injection
CVE-2023-30625HIGH
rudder-server vulnerable to SQL Injection
58RIESGO
abrir ↗
Nucleicritical
MStore API < 3.9.8 - SQL Injection
CVE-2023-3077—
MStore API < 3.9.8 - Unauthenticated Blind SQLi
18RIESGO
abrir ↗
Nucleimedium
Advanced Custom Fields < 6.1.6 - Cross-Site Scripting
CVE-2023-30777HIGH
WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)
68RIESGO
abrir ↗
Nucleimedium
Tree Page View Plugin < 1.6.7 - Cross-Site Scripting
CVE-2023-30868HIGH
WordPress CMS Tree Page View Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)
56RIESGO
abrir ↗
Nucleicritical
Easy Digital Downloads - Privilege Escalation
CVE-2023-30869CRITICAL
WordPress Easy Digital Downloads Plugin 3.1-3.1.1.4.1 is vulnerable to Privilege Escalation
43RIESGO
abrir ↗
Nucleimedium
Moodle - Cross-Site Scripting/Remote Code Execution
CVE-2023-30943MEDIUM
Moodle: tinymce loaders susceptible to arbitrary folder creation
28RIESGO
abrir ↗
Nucleihigh
Repetier Server - Directory Traversal
CVE-2023-31059HIGH
Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstra
56RIESGO
abrir ↗
← anteriorpágina 94 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.