Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
24.460 exploits
Exploit-DB
DLINK DIR850 - Insecure Access Control
DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote
35RIESGO
abrir ↗Exploit-DB
Anuko Time Tracker - SQLi (Authenticated)
SQL injection in anuko timetracker
41RIESGO
abrir ↗Exploit-DB
Bookeen Notea - Directory Traversal
Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to
23RIESGO
abrir ↗Exploit-DB
Wondershare Dr.Fone 12.0.7 - Remote Code Execution (RCE)
Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an
28RIESGO
abrir ↗Exploit-DB
DLINK DAP-1620 A1 v1.01 - Directory Traversal
Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd]
50RIESGO
abrir ↗Exploit-DB
Akka HTTP 10.1.14 - Denial of Service
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, whic
35RIESGO
abrir ↗Exploit-DB
Gitlab 14.9 - Authentication Bypass
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE
85RIESGO
abrir ↗Exploit-DB
GitLab 14.9 - Stored Cross-Site Scripting (XSS)
Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 befor
63RIESGO
abrir ↗Exploit-DB
PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)
Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to
38RIESGO
abrir ↗Exploit-DB
REDCap 11.3.9 - Stored Cross Site Scripting
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows
23RIESGO
abrir ↗Exploit-DB
Easy Appointments 1.4.2 - Information Disclosure
Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
75RIESGO
abrir ↗Exploit-DB
WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated)
Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting
35RIESGO
abrir ↗Exploit-DB
Zyxel NWA-1100-NH - Command Injection
A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to exec
70RIESGO
abrir ↗Exploit-DB
Telesquare TLR-2855KS6 - Arbitrary File Creation
An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
43RIESGO
abrir ↗Exploit-DB
Telesquare TLR-2855KS6 - Arbitrary File Deletion
An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system fil
60RIESGO
abrir ↗Exploit-DB
Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)
Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privilege
50RIESGO
abrir ↗Exploit-DB
SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups acce
33RIESGO
abrir ↗Exploit-DB
Kramer VIAware - Remote Code Execution (RCE) (Root)
KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits runn
60RIESGO
abrir ↗Exploit-DB
Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might
23RIESGO
abrir ↗Exploit-DB
Kramer VIAware - Remote Code Execution (RCE) (Root)
KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePa
50RIESGO
abrir ↗Exploit-DB
ImpressCMS 1.4.2 - Remote Code Execution (RCE)
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
43RIESGO
abrir ↗Exploit-DB
Kramer VIAware 2.5.0719.1034 - Remote Code Execution (RCE)
Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.
28RIESGO
abrir ↗Exploit-DB
WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
Easy Cookie Policy <= 1.6.2 - Broken Access Control to Stored Cross-Site Scripting
28RIESGO
abrir ↗Exploit-DB
iRZ Mobile Router - CSRF to RCE
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in
35RIESGO
abrir ↗Exploit-DB
Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut
100RIESGO
abrir ↗Exploit-DB
Pluck CMS 4.7.16 - Remote Code Execution (RCE) (Authenticated)
In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remot
35RIESGO
abrir ↗Exploit-DB
Tiny File Manager 2.4.6 - Remote Code Execution (RCE)
A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to
23RIESGO
abrir ↗Exploit-DB
Tiny File Manager 2.4.6 - Remote Code Execution (RCE)
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7
45RIESGO
abrir ↗Exploit-DB
Apache APISIX 2.12.1 - Remote Code Execution (RCE)
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.