Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.957exploits catalogados

32.195CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8182Nuclei 4217Metasploit 3462✓ solo verificadosrecientes populares riesgo

4217 exploits

Nucleimedium

WordPress BackupBuddy <8.8.3 - Cross Site Scripting

CVE-2022-4897MEDIUM

BackupBuddy < 8.8.3 - Multiple Reflected Cross-Site Scripting

28RIESGO

abrir ↗

Nucleihigh

WCFM Membership <= 2.10.0 - Broken Access Control

CVE-2022-4940HIGH

WCFM Membership <= 2.10.0 - Missing Authorization

36RIESGO

abrir ↗

Nucleimedium

Sassy Social Share <= 3.3.3 - Cross-Site Scripting

CVE-2022-4971MEDIUM

Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting

33RIESGO

abrir ↗

Nucleicritical

WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection

CVE-2023-0037CRITICAL

10WebMapBuilder < 1.0.73 - Unauthenticated SQLi

63RIESGO

abrir ↗

Nucleimedium

Simple URLs < 115 - Cross Site Scripting

CVE-2023-0099—

Simple URLs < 115 - Multiple Reflected XSS

18RIESGO

abrir ↗

Nucleihigh

SonicWall SMA1000 LFI

CVE-2023-0126HIGH

Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated atta

58RIESGO

abrir ↗

Nucleihigh

Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE

CVE-2023-0159—

Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE

50RIESGO

abrir ↗

Nucleimedium

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

CVE-2023-0236MEDIUM

Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting

28RIESGO

abrir ↗

Nucleihigh

WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection

CVE-2023-0261HIGH

WP TripAdvisor Review Slider < 10.8 - Subscriber+ SQLi

36RIESGO

abrir ↗

Nucleicritical

PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)

CVE-2023-0297CRITICAL

Code Injection in pyload/pyload

85RIESGO

abrir ↗

Nucleimedium

ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting

CVE-2023-0334MEDIUM

ShortPixel Adaptive Images < 3.6.3 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

WP Helper Lite < 4.3 - Cross-Site Scripting

CVE-2023-0448MEDIUM

The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resultin

40RIESGO

abrir ↗

Nucleimedium

Membership Database <= 1.0 - Cross-Site Scripting

CVE-2023-0514MEDIUM

Membership Database <= 1.0 - Reflected XSS

28RIESGO

abrir ↗

Nucleimedium

Online Security Guards Hiring System - Cross-Site Scripting

CVE-2023-0527LOW

PHPGurukul Online Security Guards Hiring System search-request.php cross site scripting

43RIESGO

abrir ↗

Nucleimedium

WordPress Pie Register <3.8.2.3 - Open Redirect

CVE-2023-0552MEDIUM

Pie Register < 3.8.2.3 - Open Redirect

33RIESGO

abrir ↗

Nucleicritical

Bank Locker Management System v1.0 - SQL Injection

CVE-2023-0562HIGH

PHPGurukul Bank Locker Management System Login index.php sql injection

48RIESGO

abrir ↗

Nucleimedium

Bank Locker Management System - Cross-Site Scripting

CVE-2023-0563LOW

PHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scripting

35RIESGO

abrir ↗

Nucleicritical

WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection

CVE-2023-0600CRITICAL

WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi

63RIESGO

abrir ↗

Nucleimedium

Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting

CVE-2023-0602—

Twittee Text Tweet <= 1.0.8 - Reflected XSS

18RIESGO

abrir ↗

Nucleihigh

Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection

CVE-2023-0630—

Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL Injection

18RIESGO

abrir ↗

Nucleihigh

Fortra GoAnywhere MFT - Remote Code Execution

CVE-2023-0669HIGHbajo ataqueransomware

Fortra GoAnywhere MFT License Response Servlet Command Injection

100RIESGO

abrir ↗

Nucleimedium

phpIPAM 1.5.1 - Cross-site Scripting

CVE-2023-0676LOW

Cross-site Scripting (XSS) - Reflected in phpipam/phpipam

23RIESGO

abrir ↗

Nucleimedium

PHPIPAM <v1.5.1 - Missing Authorization

CVE-2023-0678HIGH

Missing Authorization in phpipam/phpipam

48RIESGO

abrir ↗

Nucleicritical

modoboa 2.0.4 - Admin TakeOver

CVE-2023-0777HIGH

Authentication Bypass by Primary Weakness in modoboa/modoboa

61RIESGO

abrir ↗

Nucleimedium

WordPress Meta SEO <= 4.5.2 - Open Redirect

CVE-2023-0876MEDIUM

WP Meta SEO < 4.5.3 - Subscriber+ Improper Authorization causing Arbitrary Redirect

28RIESGO

abrir ↗

Nucleicritical

Purchase Order Management v1.0 - SQL Injection

CVE-2023-2130MEDIUM

SourceCodester Purchase Order Management System GET Parameter view_details.php sql injection

28RIESGO

abrir ↗

Nucleimedium

Aajoda Testimonials < 2.2.2 - Cross-Site Scripting

CVE-2023-2178—

Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS

18RIESGO

abrir ↗

Nucleihigh

Oracle Peoplesoft - Unauthenticated File Read

CVE-2023-22047HIGH

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers

58RIESGO

abrir ↗

Nucleimedium

Adobe Connect < 12.1.5 - Local File Disclosure

CVE-2023-22232MEDIUM

Adobe Connect Improper Access Control Security feature bypass

70RIESGO

abrir ↗

Nucleimedium

Seo By 10Web < 1.2.7 - Cross-Site Scripting

CVE-2023-2224MEDIUM

Seo By 10Web < 1.2.7 - Admin+ Stored XSS

28RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.