Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
24.460 exploits
Exploit-DB
Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
CVE-2021-46422—remotehardware03 jun 2022
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute
60RIESGO
abrir ↗
Exploit-DB
Contao 4.13.2 - Cross-Site Scripting (XSS)
CVE-2022-1588—webappsphp03 jun 2022
20RIESGO
abrir ↗
Exploit-DB
Microweber CMS 1.2.15 - Account Takeover
CVE-2022-1631MEDIUMwebappsphp03 jun 2022
Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber
33RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2)
CVE-2020-7246—webappsphp25 may 2022
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code
60RIESGO
abrir ↗
Exploit-DB
m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)
CVE-2022-23626HIGHwebappsphp23 may 2022
Insufficient file checks in m1k1o/blog
41RIESGO
abrir ↗
Exploit-DB
SolarView Compact 6.0 - OS Command Injection
CVE-2022-29303CRITICALbajo ataqueremotehardware17 may 2022
SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.
100RIESGO
abrir ↗
Exploit-DB
SDT-CW3B1 1.1.0 - OS Command Injection
CVE-2021-46422—remotehardware17 may 2022
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute
60RIESGO
abrir ↗
Exploit-DB
Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
CVE-2022-0967MEDIUMwebappsphp17 may 2022
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc
33RIESGO
abrir ↗
Exploit-DB
Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
CVE-2022-29727—webappsmultiple17 may 2022
Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup param
23RIESGO
abrir ↗
Exploit-DB
College Management System 1.0 - 'course_code' SQL Injection (Authenticated)
CVE-2022-28079—webappsphp12 may 2022
College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.
43RIESGO
abrir ↗
Exploit-DB
Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
CVE-2022-28080—webappsphp12 may 2022
Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.
50RIESGO
abrir ↗
Exploit-DB
TLR-2005KSH - Arbitrary File Delete
CVE-2021-46424—webappshardware12 may 2022
Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to de
50RIESGO
abrir ↗
Exploit-DB
F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
CVE-2022-1388CRITICALbajo ataqueransomwareremotemultiple12 may 2022
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RIESGO
abrir ↗
Exploit-DB
Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting (XSS)
CVE-2021-31673—webappsmultiple11 may 2022
A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remo
23RIESGO
abrir ↗
Exploit-DB
Bookeen Notea - Directory Traversal
CVE-2021-45783—remoteandroid11 may 2022
Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to
23RIESGO
abrir ↗
Exploit-DB
Wondershare Dr.Fone 12.0.7 - Remote Code Execution (RCE)
CVE-2021-44596—remotewindows11 may 2022
Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an
28RIESGO
abrir ↗
Exploit-DB
Google Chrome 78.0.3904.70 - Remote Code Execution
CVE-2019-13720HIGHbajo ataqueremotemultiple11 may 2022
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap
93RIESGO
abrir ↗
Exploit-DB
ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure
CVE-2022-29457—remotewindows11 may 2022
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131
23RIESGO
abrir ↗
Exploit-DB
Navigate CMS 2.9.4 - Server-Side Request Forgery (SSRF) (Authenticated)
CVE-2022-28117—webappsphp11 may 2022
A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the ap
43RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)
CVE-2022-1103—webappsphp11 may 2022
Advanced Uploader <= 4.2 - Subscriber+ Arbitrary File Upload
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Wondershare Dr.Fone 12.0.7 - Privilege Escalation (ElevationService)
CVE-2021-44595—localwindows11 may 2022
Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send m
28RIESGO
abrir ↗
Exploit-DB
SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)
CVE-2022-28213—remotemultiple11 may 2022
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does n
28RIESGO
abrir ↗
Exploit-DB
Ruijie Reyee Mesh Router - Remote Code Execution (RCE) (Authenticated)
CVE-2021-43164—remotehardware11 may 2022
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.191
35RIESGO
abrir ↗
Exploit-DB
TLR-2005KSH - Arbitrary File Upload
CVE-2021-45428—webappshardware11 may 2022
TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can uploa
50RIESGO
abrir ↗
Exploit-DB
ExifTool 12.23 - Arbitrary Code Execution
CVE-2021-22204MEDIUMbajo ataquelocallinux11 may 2022
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RIESGO
abrir ↗
Exploit-DB
Akka HTTP 10.1.14 - Denial of Service
CVE-2021-42697—remotemultiple11 may 2022
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, whic
35RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
CVE-2021-24581—webappsphp11 may 2022
Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)
23RIESGO
abrir ↗
Exploit-DB
DLINK DIR850 - Insecure Access Control
CVE-2021-46378—remotehardware11 may 2022
DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote
35RIESGO
abrir ↗
Exploit-DB
DLINK DIR850 - Open Redirect
CVE-2021-46379—remotehardware11 may 2022
DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrust
43RIESGO
abrir ↗
Exploit-DB
WebTareas 2.4 - Blind SQLi (Authenticated)
CVE-2021-43481—webappsphp11 may 2022
An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstag
23RIESGO
abrir ↗
← anteriorpágina 29 / 816siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.