Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.886exploits catalogados

32.153CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8176Nuclei 4202Metasploit 3462✓ solo verificadosrecientes populares riesgo

4202 exploits

Nucleimedium

FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting

CVE-2021-39350MEDIUM

FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting

28RIESGO

abrir ↗

Nucleihigh

Hospital Management System 1.0 - Cross-Site Scripting

CVE-2021-39411—

Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searc

18RIESGO

abrir ↗

Nucleihigh

BIQS IT Biqs-drive v1.83 Local File Inclusion

CVE-2021-39433—

A local file inclusion (LFI) vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific

18RIESGO

abrir ↗

Nucleimedium

EyouCMS 1.5.4 Open Redirect

CVE-2021-39501—

EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function

18RIESGO

abrir ↗

Nucleimedium

Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure

CVE-2021-40149—

The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory.

18RIESGO

abrir ↗

Nucleihigh

Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosure

CVE-2021-40150—

The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapp

18RIESGO

abrir ↗

Nucleimedium

IRTS OP5 Monitor - Cross-Site Scripting

CVE-2021-40272MEDIUM

OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).

28RIESGO

abrir ↗

Nucleicritical

Cobbler <3.3.0 - Remote Code Execution

CVE-2021-40323—

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the lo

40RIESGO

abrir ↗

Nucleicritical

Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery

CVE-2021-40438CRITICALbajo ataque

mod_proxy SSRF

100RIESGO

abrir ↗

Nucleicritical

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

CVE-2021-40539CRITICALbajo ataqueransomware

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta

100RIESGO

abrir ↗

Nucleihigh

Apache 2.4.49 - Path Traversal and Remote Code Execution

CVE-2021-41773HIGHbajo ataqueransomware

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RIESGO

abrir ↗

Nucleimedium

PlaceOS 1.2109.1 - Open Redirection

CVE-2021-41826—

PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.

23RIESGO

abrir ↗

Nucleimedium

i-Panel Administration System 2.0 - Cross-Site Scripting

CVE-2021-41878—

A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enable

38RIESGO

abrir ↗

Nucleimedium

GitLab GraphQL API User Enumeration

CVE-2021-4191MEDIUM

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Priv

70RIESGO

abrir ↗

Nucleimedium

Resourcespace - Cross-Site Scripting

CVE-2021-41951—

ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_ss

40RIESGO

abrir ↗

Nucleicritical

Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution

CVE-2021-42013CRITICALbajo ataqueransomware

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RIESGO

abrir ↗

Nucleimedium

SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting

CVE-2021-42063—

A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage

43RIESGO

abrir ↗

Nucleicritical

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection

CVE-2021-42071—

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharac

50RIESGO

abrir ↗

Nucleihigh

KONGA 0.14.9 - Privilege Escalation

CVE-2021-42192—

Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to pri

23RIESGO

abrir ↗

Nucleicritical

Sitecore Experience Platform Pre-Auth RCE

CVE-2021-42237CRITICALbajo ataqueransomware

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it

100RIESGO

abrir ↗

Nucleicritical

BillQuick Web Suite SQL Injection

CVE-2021-42258CRITICALbajo ataqueransomware

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution

95RIESGO

abrir ↗

Nucleihigh

WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Arbitrary Post Deletion

CVE-2021-42359HIGH

WP DSGVO Tools (GDPR) <= 3.1.23 Unauthenticated Arbitrary Post Deletion

36RIESGO

abrir ↗

Nucleimedium

NetBiblio WebOPAC - Cross-Site Scripting

CVE-2021-42551MEDIUM

Reflected XSS in NetBiblio WebOPAC search functionality

28RIESGO

abrir ↗

Nucleimedium

myfactory FMS - Cross-Site Scripting

CVE-2021-42565—

myfactory.FMS before 7.1-912 allows XSS via the UID parameter.

38RIESGO

abrir ↗

Nucleimedium

myfactory FMS - Cross-Site Scripting

CVE-2021-42566—

myfactory.FMS before 7.1-912 allows XSS via the Error parameter.

38RIESGO

abrir ↗

Nucleimedium

Apereo CAS Cross-Site Scripting

CVE-2021-42567—

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.

18RIESGO

abrir ↗

Nucleicritical

D-Link DIR-615 - Unauthorized Access

CVE-2021-42627—

The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without auth

30RIESGO

abrir ↗

Nucleimedium

Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting

CVE-2021-42663—

An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via th

18RIESGO

abrir ↗

Nucleicritical

Online Event Booking and Reservation System 2.3.0 - SQL Injection

CVE-2021-42667—

A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-manag

23RIESGO

abrir ↗

Nucleicritical

TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass

CVE-2021-42887—

In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

30RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.