Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.864exploits catalogados

32.153CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.280VulnCheck XDB 8156Nuclei 4202Metasploit 3462✓ solo verificadosrecientes populares riesgo

4202 exploits

Nucleimedium

WordPress PhastPress <1.111 - Open Redirect

CVE-2021-24210—

PhastPress < 1.111 - Open Redirect

18RIESGO

abrir ↗

Nucleicritical

WooCommerce Help Scout - Arbitrary File Upload

CVE-2021-24212—

WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE

18RIESGO

abrir ↗

Nucleimedium

GiveWP <= 2.9.7 - Cross-Site Scripting

CVE-2021-24213—

GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting

CVE-2021-24214—

OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error

18RIESGO

abrir ↗

Nucleicritical

Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation

CVE-2021-24215—

Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation

18RIESGO

abrir ↗

Nucleimedium

All Thrive Themes and Plugins - Unauthenticated Option Update

CVE-2021-24219—

All Thrive Themes and Plugins - Unauthenticated Option Update

18RIESGO

abrir ↗

Nucleicritical

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

CVE-2021-24220—

All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion

18RIESGO

abrir ↗

Nucleihigh

AccessAlly <3.5.7 - Sensitive Information Leakage

CVE-2021-24226—

AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage

18RIESGO

abrir ↗

Nucleihigh

Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion

CVE-2021-24227—

Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

18RIESGO

abrir ↗

Nucleimedium

WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting

CVE-2021-24235—

Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS

18RIESGO

abrir ↗

Nucleicritical

WordPress Imagements <=1.2.5 - Arbitrary File Upload

CVE-2021-24236—

Imagements <= 1.2.5 - Unauthenticated Arbitrary File Upload to RCE

18RIESGO

abrir ↗

Nucleimedium

WordPress Realteo <=1.2.3 - Cross-Site Scripting

CVE-2021-24237—

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress Pie Register <3.7.0.1 - Cross-Site Scripting

CVE-2021-24239—

Pie Register < 3.7.0.1 - Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress Stop Spammers <2021.9 - Cross-Site Scripting

CVE-2021-24245—

Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)

38RIESGO

abrir ↗

Nucleimedium

WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting

CVE-2021-24274—

Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)

43RIESGO

abrir ↗

Nucleimedium

Popup by Supsystic <1.10.5 - Cross-Site scripting

CVE-2021-24275—

Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)

43RIESGO

abrir ↗

Nucleimedium

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

CVE-2021-24276—

Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)

43RIESGO

abrir ↗

Nucleihigh

WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation

CVE-2021-24278—

Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation

18RIESGO

abrir ↗

Nucleicritical

WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload

CVE-2021-24284—

Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload

30RIESGO

abrir ↗

Nucleicritical

WordPress Car Seller - Auto Classifieds Script - SQL Injection

CVE-2021-24285—

Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection

23RIESGO

abrir ↗

Nucleimedium

WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting

CVE-2021-24286—

Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)

43RIESGO

abrir ↗

Nucleimedium

WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

CVE-2021-24287—

Select All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS)

43RIESGO

abrir ↗

Nucleimedium

WordPress AcyMailing <7.5.0 - Open Redirect

CVE-2021-24288—

AcyMailing < 7.5.0 - Unauthenticated Open Redirect

18RIESGO

abrir ↗

Nucleimedium

WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting

CVE-2021-24291—

Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)

23RIESGO

abrir ↗

Nucleihigh

Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection

CVE-2021-24295—

Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4

18RIESGO

abrir ↗

Nucleimedium

WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting

CVE-2021-24298—

Simple Giveaways < 2.36.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress WooCommerce <1.13.22 - Cross-Site Scripting

CVE-2021-24300—

PickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS)

43RIESGO

abrir ↗

Nucleicritical

WordPress Perfect Survey <1.5.2 - SQL Injection

CVE-2021-24762—

Perfect Survey < 1.5.2 - Unauthenticated SQL Injection

60RIESGO

abrir ↗

Nucleihigh

Download Monitor < 4.4.5 - SQL Injection

CVE-2021-24786HIGH

Download Monitor < 4.4.5 - Admin+ SQL Injection

61RIESGO

abrir ↗

Nucleihigh

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection

CVE-2021-24791—

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections

18RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.