Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
24.460 exploits
Exploit-DB
Cacti v1.2.22 - Remote Command Execution (RCE)
CVE-2022-46169CRITICALbajo ataquewebappsphp31 mar 2023
Unauthenticated Command Injection
100RIESGO
abrir ↗
Exploit-DB
rconfig 3.9.7 - Sql Injection (Authenticated)
CVE-2022-45030HIGHwebappsphp31 mar 2023
A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may
41RIESGO
abrir ↗
Exploit-DB
EQ Enterprise management system v2.2.0 - SQL Injection
CVE-2022-45297CRITICALwebappsasp31 mar 2023
EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.
48RIESGO
abrir ↗
Exploit-DB
qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS)
CVE-2022-46770HIGHdoshardware31 mar 2023
qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of s
61RIESGO
abrir ↗
Exploit-DB
LISTSERV 17 - Reflected Cross Site Scripting (XSS)
CVE-2022-39195MEDIUMwebappscgi30 mar 2023
A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary
48RIESGO
abrir ↗
Exploit-DB
CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token
CVE-2022-2841LOWlocalwindows30 mar 2023
CrowdStrike Falcon Uninstallation authorization
28RIESGO
abrir ↗
Exploit-DB
Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)
CVE-2022-24629CRITICALwebappsphp30 mar 2023
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achie
60RIESGO
abrir ↗
Exploit-DB
Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)
CVE-2022-24627CRITICALwebappsphp30 mar 2023
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injec
68RIESGO
abrir ↗
Exploit-DB
Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)
CVE-2022-24630—webappsphp30 mar 2023
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh
28RIESGO
abrir ↗
Exploit-DB
Dreamer CMS v4.0.0 - SQL Injection
CVE-2022-43128—webappsmultiple30 mar 2023
20RIESGO
abrir ↗
Exploit-DB
Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)
CVE-2022-24632—webappsphp30 mar 2023
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during f
28RIESGO
abrir ↗
Exploit-DB
LISTSERV 17 - Insecure Direct Object Reference (IDOR)
CVE-2022-40319HIGHwebappscgi30 mar 2023
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a
41RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WP All Import v3.6.7 - Remote Code Execution (RCE) (Authenticated)
CVE-2022-1565HIGHwebappsphp29 mar 2023
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
46RIESGO
abrir ↗
Exploit-DB
Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access
CVE-2022-37255HIGHremotehardware28 mar 2023
TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL07552646
41RIESGO
abrir ↗
Exploit-DB
Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF)
CVE-2022-36551—webappspython28 mar 2023
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.
23RIESGO
abrir ↗
Exploit-DB
ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS)
CVE-2022-41441MEDIUMwebappsaspx28 mar 2023
Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts o
48RIESGO
abrir ↗
Exploit-DB
ZKTeco ZEM/ZMM 8.88 - Missing Authentication
CVE-2022-42953HIGHwebappsjsp28 mar 2023
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct r
41RIESGO
abrir ↗
Exploit-DB
OPSWAT Metadefender Core - Privilege Escalation
CVE-2022-32272—webappsmultiple28 mar 2023
OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
BoxBilling<=4.22.1.5 - Remote Code Execution (RCE)
CVE-2022-3552HIGHwebappsphp28 mar 2023
Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling
53RIESGO
abrir ↗
Exploit-DB
Pega Platform 8.1.0 - Remote Code Execution (RCE)
CVE-2022-24082CRITICALwebappsmultiple28 mar 2023
If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Inte
53RIESGO
abrir ↗
Exploit-DB
X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)
CVE-2022-38580CRITICALremotemultiple28 mar 2023
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
53RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass
CVE-2022-39285HIGHwebappsphp27 mar 2023
Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder
41RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass
CVE-2022-39290HIGHwebappsphp27 mar 2023
CSRF key bypass using HTTP methods in zoneminder
41RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Zoneminder < v1.37.24 - Log Injection & Stored XSS & CSRF Bypass
CVE-2022-39291MEDIUMwebappsphp27 mar 2023
Denial of service through logs in zoneminder
33RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Grafana <=6.2.4 - HTML Injection
CVE-2019-13068—webappstypescript27 mar 2023
public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the
35RIESGO
abrir ↗
Exploit-DB
FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass
CVE-2022-40684CRITICALbajo ataqueransomwarewebappsmultiple27 mar 2023
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Composr-CMS Version <=10.0.39 - Authenticated Remote Code Execution
CVE-2021-46360—webappsphp25 mar 2023
Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrar
23RIESGO
abrir ↗
Exploit-DB
Password Manager for IIS v2.0 - XSS
CVE-2022-36664MEDIUMwebappsasp25 mar 2023
Password Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultURL
33RIESGO
abrir ↗
Exploit-DB
System Mechanic v15.5.0.61 - Arbitrary Read/Write
CVE-2018-5701—localwindows25 mar 2023
In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerabi
28RIESGO
abrir ↗
Exploit-DB
ImpressCMS v1.4.3 - Authenticated SQL Injection
CVE-2022-26986—webappsphp25 mar 2023
SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this al
23RIESGO
abrir ↗
← anteriorpágina 26 / 816siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.