Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.957exploits catalogados
32.195CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8182Nuclei 4217Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4217 exploits
Nucleimedium
LocalAI - Partial Local File Read
CVE-2024-6095MEDIUM
SSRF and Partial LFI in /models/apply Endpoint in mudler/localai
28RIESGO
abrir ↗
Nucleicritical
Push Notification for Post and BuddyPress <= 1.93 - SQL Injection
CVE-2024-6159CRITICAL
Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi
63RIESGO
abrir ↗
Nucleimedium
TrakSYS 11.x.x - Sensitive Data Exposure
CVE-2024-6188MEDIUM
Parsec Automation TrackSYS pagedefinition direct request
28RIESGO
abrir ↗
Nucleicritical
PayPlus Payment Gateway < 6.6.9 - SQL Injection
CVE-2024-6205HIGH
PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi
56RIESGO
abrir ↗
Nucleicritical
WordPress Keydatas ≤ 2.5.2 - Arbitrary File Upload
CVE-2024-6220CRITICAL
简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload
55RIESGO
abrir ↗
Nucleicritical
NetScaler Console - Sensitive Information Disclosure
CVE-2024-6235CRITICAL
Sensitive information disclosure
48RIESGO
abrir ↗
Nucleihigh
LOLLMS WebUI - Absolute Path Traversal
CVE-2024-6250HIGH
Absolute Path Traversal in parisneo/lollms-webui
36RIESGO
abrir ↗
Nucleicritical
UsersWP <= 1.2.10 - Unauthenticated SQL Injection
CVE-2024-6265CRITICAL
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'
43RIESGO
abrir ↗
Nucleimedium
WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure
CVE-2024-6289MEDIUM
WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure
28RIESGO
abrir ↗
Nucleihigh
User Profile Builder < 3.11.8 - File Upload
CVE-2024-6366CRITICAL
User Profile Builder < 3.11.8 - Unauthenticated Media Upload
68RIESGO
abrir ↗
Nucleicritical
Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
CVE-2024-6396CRITICAL
Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim
55RIESGO
abrir ↗
Nucleihigh
Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure
CVE-2024-6420HIGH
Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure
36RIESGO
abrir ↗
Nucleicritical
WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion
CVE-2024-6460CRITICAL
Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI
63RIESGO
abrir ↗
Nucleimedium
Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting
CVE-2024-6517MEDIUM
Contact Form 7 Math Captcha <= 2.0.1 - Reflected XSS
28RIESGO
abrir ↗
Nucleimedium
WP Popups - Information Disclosure
CVE-2024-6555MEDIUM
WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure
28RIESGO
abrir ↗
Nucleimedium
Campaign Monitor for WordPress - Information Disclosure
CVE-2024-6569MEDIUM
Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure
28RIESGO
abrir ↗
Nucleihigh
Lightdash v0.1024.6 - Server-Side Request Forgery
CVE-2024-6586HIGH
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and s
36RIESGO
abrir ↗
Nucleihigh
LiteLLM - Server-Side Request Forgery
CVE-2024-6587HIGH
SSRF in berriai/litellm
48RIESGO
abrir ↗
Nucleimedium
Netgear-WN604 downloadFile.php - Information Disclosure
CVE-2024-6646MEDIUM
Netgear WN604 Web Interface downloadFile.php information disclosure
40RIESGO
abrir ↗
Nucleihigh
WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting
CVE-2024-6651MEDIUM
WordPress File Upload < 4.24.8 - Reflected XSS
33RIESGO
abrir ↗
Nucleicritical
WhatsUp Gold HasErrors SQL Injection - Authentication Bypass
CVE-2024-6670CRITICALbajo ataqueransomware
WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability
100RIESGO
abrir ↗
Nucleicritical
WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass
CVE-2024-6671CRITICAL
WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability
48RIESGO
abrir ↗
Nucleimedium
WP Content Copy Protection & No Right Click - Open Redirect
CVE-2024-6690MEDIUM
WP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirect
28RIESGO
abrir ↗
Nucleimedium
EasySpider 0.6.2 - Arbitrary File Read
CVE-2024-6746MEDIUM
NaiboWang EasySpider HTTP GET Request server.js path traversal
28RIESGO
abrir ↗
Nucleihigh
Social Auto Poster <= 5.3.14 - Stored Cross-Site Scripting
CVE-2024-6753HIGH
Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting
36RIESGO
abrir ↗
Nucleihigh
Calibre <= 7.14.0 Arbitrary File Read
CVE-2024-6781HIGH
Calibre Arbitrary File Read
48RIESGO
abrir ↗
Nucleicritical
Calibre <= 7.14.0 Remote Code Execution
CVE-2024-6782CRITICAL
Calibre Remote Code Execution
85RIESGO
abrir ↗
Nucleihigh
AnythingLLM - Information Disclosure
CVE-2024-6842HIGH
Exposure of Sensitive Information in mintplex-labs/anything-llm
41RIESGO
abrir ↗
Nucleimedium
SmartSearchWP < 2.4.6 - OpenAI Key Disclosure
CVE-2024-6845MEDIUM
SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure
28RIESGO
abrir ↗
Nucleimedium
SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
CVE-2024-6846MEDIUM
SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
28RIESGO
abrir ↗
← anteriorpágina 126 / 141siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.