Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.957exploits catalogados
32.195CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8182Nuclei 4217Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4217 exploits
Nucleicritical
Chartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusion
CVE-2024-10571CRITICAL
Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source
63RIESGO
abrir ↗
Nucleicritical
WordPress HTML5 Video Player - SQL Injection
CVE-2024-1061HIGH
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerabilit
41RIESGO
abrir ↗
Nucleimedium
System Dashboard < 2.8.15 - Admin+ Path Traversal
CVE-2024-10708MEDIUM
System Dashboard < 2.8.15 - Admin+ Path Traversal
28RIESGO
abrir ↗
Nucleicritical
WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection
CVE-2024-1071CRITICAL
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
85RIESGO
abrir ↗
Nucleicritical
WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion
CVE-2024-10763CRITICAL
Campress <= 1.35 - Unauthenticated Local File Inclusion
43RIESGO
abrir ↗
Nucleihigh
WordPress Plugin MainWP Child - Authentication Bypass
CVE-2024-10783HIGH
MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation
36RIESGO
abrir ↗
Nucleimedium
GPT Academic v1.3.9 - Open Redirect
CVE-2024-10812MEDIUM
Open Redirect in binary-husky/gpt_academic
28RIESGO
abrir ↗
Nucleimedium
FastChat - Open Redirect
CVE-2024-10908MEDIUM
Open Redirect in lm-sys/fastchat
28RIESGO
abrir ↗
Nucleicritical
D-Link NAS - Command Injection via Name Parameter
CVE-2024-10914CRITICAL
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RIESGO
abrir ↗
Nucleicritical
D-Link NAS - Command Injection via Group Parameter
CVE-2024-10915CRITICAL
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RIESGO
abrir ↗
Nucleicritical
Really Simple Security < 9.1.2 - Authentication Bypass
CVE-2024-10924CRITICAL
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
85RIESGO
abrir ↗
Nucleimedium
Stable Diffusion Webui 1.10.0 - Open Redirect
CVE-2024-11044MEDIUM
Open Redirect in automatic1111/stable-diffusion-webui
28RIESGO
abrir ↗
Nucleimedium
Landray EKP - Path Traversal
CVE-2024-11238MEDIUM
Landray EKP sysUiComponent.do delPreviewFile path traversal
28RIESGO
abrir ↗
Nucleihigh
Korenix JetPort 5601v3 - Path Traversal
CVE-2024-11303HIGH
Path Traversal
36RIESGO
abrir ↗
Nucleimedium
Altenergy Power Control Software - SQL Injection
CVE-2024-11305MEDIUM
Altenergy Power Control Software status_zigbee get_status_zigbee sql injection
28RIESGO
abrir ↗
Nucleicritical
Pandora v7.0NG.777.3 - Remote Code Execution
CVE-2024-11320MEDIUM
Command Injection leading to RCE via LDAP Misconfiguration
50RIESGO
abrir ↗
Nucleimedium
Event Monster <= 1.4.3 - Information Exposure Via Visitors List Export
CVE-2024-11396MEDIUM
Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
28RIESGO
abrir ↗
Nucleimedium
idcCMS V1.60 - Cross-Site Scripting
CVE-2024-11587MEDIUM
idcCMS classProvCity.php GetCityOptionJs cross site scripting
28RIESGO
abrir ↗
Nucleicritical
ProjectSend <= r1605 - Improper Authorization
CVE-2024-11680CRITICALbajo ataque
ProjectSend Unauthenticated Configuration Modification
100RIESGO
abrir ↗
Nucleihigh
KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection
CVE-2024-11728HIGH
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
61RIESGO
abrir ↗
Nucleihigh
Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution
CVE-2024-11740HIGH
Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution
36RIESGO
abrir ↗
Nucleimedium
Gradio - Server Side Request Forgery
CVE-2024-1183MEDIUM
SSRF Vulnerability in gradio-app/gradio
28RIESGO
abrir ↗
Nucleimedium
LearnPress < 4.2.7.4 - Course Material - Information Disclosure
CVE-2024-11868MEDIUM
LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API
28RIESGO
abrir ↗
Nucleihigh
Give WP Plugin < 3.19.0 - Cross-Site Scripting
CVE-2024-11921MEDIUM
Give < 3.19.0 - Reflected XSS
28RIESGO
abrir ↗
Nucleicritical
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
CVE-2024-11972CRITICAL
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
75RIESGO
abrir ↗
Nucleimedium
W3 Total Cache < 2.8.2 - Log File Exposure
CVE-2024-12008MEDIUM
W3 Total Cache <= 2.8.1 Information Exposure via Log Files
28RIESGO
abrir ↗
Nucleihigh
WordPress Collapsing Categories <= 3.0.8 - SQL Injection
CVE-2024-12025HIGH
Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection
56RIESGO
abrir ↗
Nucleimedium
LearnDash LMS < 4.10.3 - Sensitive Information Exposure
CVE-2024-1208MEDIUM
LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API
28RIESGO
abrir ↗
Nucleimedium
LearnDash LMS < 4.10.2 - Sensitive Information Exposure via assignments
CVE-2024-1209MEDIUM
LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments
28RIESGO
abrir ↗
Nucleimedium
LearnDash LMS < 4.10.2 - Sensitive Information Exposure
CVE-2024-1210MEDIUM
LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API
28RIESGO
abrir ↗
← anteriorpágina 134 / 141siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.