Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

79.207exploits catalogados

36.419CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.464Referência 23.022GitHub PoC 15.023VulnCheck XDB 8846Nuclei 4361Metasploit 3491✓ solo verificadosrecientes populares riesgo

4361 exploits

Nucleimedium

Cloudron 6.2 Cross-Site Scripting

CVE-2021-40868—

In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.

38RIESGO

Nucleicritical

Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution

CVE-2021-40870CRITICALbajo ataque

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous

100RIESGO

Nucleihigh

Gurock TestRail Application files.md5 Exposure

CVE-2021-40875—

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat ac

50RIESGO

Nucleicritical

Galera WebTemplate 1.0 Directory Traversal

CVE-2021-40960—

Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd

18RIESGO

Nucleimedium

Spotweb <= 1.5.1 - Cross Site Scripting

CVE-2021-40968—

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote

18RIESGO

Nucleimedium

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)

CVE-2021-40969—

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote

18RIESGO

Nucleimedium

Spotweb <= 1.5.1 - Cross Site Scripting

CVE-2021-40970—

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote

18RIESGO

Nucleimedium

Spotweb <= 1.5.1 - Cross Site Scripting

CVE-2021-40971—

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote

18RIESGO

Nucleimedium

Spotweb <= 1.5.1 - Cross Site Scripting

CVE-2021-40972—

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote

18RIESGO

Nucleimedium

Spotweb <= 1.5.1 - Cross Site Scripting

CVE-2021-40973—

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote

18RIESGO

Nucleihigh

MKdocs 1.2.2 - Directory Traversal

CVE-2021-40978—

The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obt

23RIESGO

Nucleihigh

Aurelia-Path < 1.1.7 - Prototype Pollution

CVE-2021-41097CRITICAL

Prototype pollution in aurelia-path

43RIESGO

Nucleimedium

Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting

CVE-2021-41174MEDIUM

XSS vulnerability allowing arbitrary JavaScript execution

70RIESGO

Nucleimedium

Redash Setup Configuration - Default Secrets Disclosure

CVE-2021-41192HIGH

Insecure default configuration

36RIESGO

Nucleicritical

MinIO Operator Console Authentication Bypass

CVE-2021-41266HIGH

Authentication bypass issue in the Operator Console

48RIESGO

Nucleihigh

Metabase - Local File Inclusion

CVE-2021-41277CRITICALbajo ataque

GeoJSON URL validation can expose server files and environment variables to unauthorized users

100RIESGO

Nucleihigh

pfSense - Arbitrary File Write

CVE-2021-41282—

diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data abo

40RIESGO

Nucleihigh

ECOA Building Automation System - Directory Traversal Content Disclosure

CVE-2021-41291HIGH

ECOA BAS controller - Path Traversal-1

58RIESGO

Nucleihigh

ECOA Building Automation System - Arbitrary File Retrieval

CVE-2021-41293HIGH

ECOA BAS controller - Path Traversal-3

41RIESGO

Nucleimedium

Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting

CVE-2021-41349MEDIUM

Microsoft Exchange Server Spoofing Vulnerability

70RIESGO

Nucleihigh

Payara Micro Community 5.2021.6 Directory Traversal

CVE-2021-41381—

Payara Micro Community 5.2021.6 and below allows Directory Traversal.

50RIESGO

Nucleicritical

QVIS NVR/DVR - Remote Code Execution

CVE-2021-41419—

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.

18RIESGO

Nucleimedium

FlatPress 1.2.1 - Stored Cross-Site Scripting

CVE-2021-41432—

A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaS

18RIESGO

Nucleihigh

ECShop 4.1.0 - SQL Injection

CVE-2021-41460—

ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.

18RIESGO

Nucleimedium

JustWriting - Cross-Site Scripting

CVE-2021-41467—

Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow rem

18RIESGO

Nucleihigh

SAS/Internet 9.4 1520 - Local File Inclusion

CVE-2021-41569—

SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the app

18RIESGO

Nucleihigh

PuneethReddyHC action.php SQL Injection

CVE-2021-41648—

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId

23RIESGO

Nucleicritical

PuneethReddyHC Online Shopping System homeaction.php SQL Injection

CVE-2021-41649—

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php c

30RIESGO

Nucleicritical

TP-Link - OS Command Injection

CVE-2021-41653—

The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to r

60RIESGO

Nucleihigh

openSIS Student Information System 8.0 SQL Injection

CVE-2021-41691CRITICAL

A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TR

43RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.