Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.957exploits catalogados
32.195CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8182Nuclei 4217Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4217 exploits
Nucleihigh
WordPress FluentForms <= 5.1.16 - Broken Access Control
CVE-2024-2782HIGH
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation
56RIESGO
abrir ↗
Nucleicritical
WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF
CVE-2024-27954CRITICAL
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability
85RIESGO
abrir ↗
Nucleicritical
WordPress Automatic Plugin <= 3.92.0 - SQL Injection
CVE-2024-27956CRITICAL
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RIESGO
abrir ↗
Nucleicritical
WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin
CVE-2024-28000CRITICAL
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
75RIESGO
abrir ↗
Nucleicritical
N-able N-central < 2024.2 - Authentication Bypass Detection
CVE-2024-28200CRITICAL
N-central Authentication Bypass
43RIESGO
abrir ↗
Nucleicritical
OpenMetaData - SpEL Injection in PUT /api/v1/policies
CVE-2024-28253CRITICAL
SpEL Injection in `PUT /api/v1/policies` in OpenMetadata
48RIESGO
abrir ↗
Nucleicritical
OpenMetadata - Authentication Bypass
CVE-2024-28255CRITICAL
Authentication Bypass in OpenMetadata
85RIESGO
abrir ↗
Nucleimedium
pyload-ng js2py - Remote Code Execution
CVE-2024-28397MEDIUM
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a
48RIESGO
abrir ↗
Nucleihigh
LG LED Assistant - Unauthenticated Password Reset
CVE-2024-2862CRITICAL
Password reset vulnerability without authorization on LG LED Assistant
55RIESGO
abrir ↗
Nucleimedium
RiteCMS 3.0.0 - Cross-site Scripting
CVE-2024-28623MEDIUM
RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_sec
48RIESGO
abrir ↗
Nucleihigh
LG LED Assistant - Thumbnail Path Traversal File Upload
CVE-2024-2863MEDIUM
Path traversal via file upload on LG LED Assistant
40RIESGO
abrir ↗
Nucleimedium
Coda v.2024Q1 - Cross-Site Scripting
CVE-2024-28734MEDIUM
Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary
28RIESGO
abrir ↗
Nucleihigh
Apache CXF < 4.0.4 - Aegis DataBinding SSRF / Local File Read
CVE-2024-28752CRITICAL
Apache CXF SSRF Vulnerability using the Aegis databinding
63RIESGO
abrir ↗
Nucleicritical
Wordpress Email Subscribers by Icegram Express - SQL Injection
CVE-2024-2876CRITICAL
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection
85RIESGO
abrir ↗
Nucleihigh
WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection
CVE-2024-2879CRITICAL
The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.1
68RIESGO
abrir ↗
Nucleicritical
SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization
CVE-2024-28986CRITICALbajo ataque
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
95RIESGO
abrir ↗
Nucleicritical
SolarWinds Web Help Desk - Hardcoded Credential
CVE-2024-28987CRITICALbajo ataque
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
100RIESGO
abrir ↗
Nucleihigh
SolarWinds Serv-U - Directory Traversal
CVE-2024-28995HIGHbajo ataque
SolarWinds Serv-U L Directory Transversal Vulnerability
100RIESGO
abrir ↗
Nucleimedium
Memos 0.13.2 - Server-Side Request Forgery
CVE-2024-29028MEDIUM
memos vulnerable to an SSRF in /o/get/httpmeta
28RIESGO
abrir ↗
Nucleimedium
Memos 0.13.2 - Cross-Site Scripting & SSRF
CVE-2024-29029MEDIUM
memos vulnerable to an SSRF in /o/get/image
28RIESGO
abrir ↗
Nucleimedium
Memos 0.13.2 - Server-Side Request Forgery
CVE-2024-29030MEDIUM
memos vulnerable to an SSRF in /api/resource
28RIESGO
abrir ↗
Nucleihigh
.NET Framework - Leaking ObjRefs via HTTP .NET Remoting
CVE-2024-29059HIGHbajo ataque
.NET Framework Information Disclosure Vulnerability
100RIESGO
abrir ↗
Nucleihigh
WordPress Tourfic Plugin <= 2.11.7 - Cross-Site Scripting
CVE-2024-29137HIGH
WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability
36RIESGO
abrir ↗
Nucleimedium
WordPress Restrict User Access <= 2.5 - Cross-Site Scripting
CVE-2024-29138HIGH
WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability
36RIESGO
abrir ↗
Nucleihigh
GeoServer Demo Request Endpoint - Server Side Request Forgery
CVE-2024-29198HIGH
GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
36RIESGO
abrir ↗
Nucleicritical
Telesquare TLR-2005KSH - Remote Command Execution
CVE-2024-29269HIGH
An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the
56RIESGO
abrir ↗
Nucleimedium
VvvebJs < 1.7.5 - Arbitrary File Upload
CVE-2024-29272MEDIUM
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute
28RIESGO
abrir ↗
Nucleihigh
MLflow < 2.11.3 - Path Traversal
CVE-2024-2928HIGH
Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow
41RIESGO
abrir ↗
Nucleimedium
Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting
CVE-2024-29792HIGH
WordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerability
36RIESGO
abrir ↗
Nucleicritical
Mura/Masa CMS - SQL Injection
CVE-2024-32640CRITICAL
MasaCMS SQL Injection vulnerability
85RIESGO
abrir ↗
← anteriorpágina 138 / 141siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.