Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.760exploits catalogados
32.083CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 19.934GitHub PoC 13.235VulnCheck XDB 8150Nuclei 4193Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4193 exploits
Nucleihigh
Ruijie RG-EW1200G Router Background - Login Bypass
CVE-2023-4415HIGH
Ruijie RG-EW1200G login improper authentication
48RIESGO
abrir ↗
Nucleimedium
Adobe Coldfusion - Cross-Site Scripting
CVE-2023-44352MEDIUM
Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version
50RIESGO
abrir ↗
Nucleicritical
Adobe ColdFusion WDDX Deserialization Gadgets
CVE-2023-44353CRITICAL
ColdFusion WDDX Deserialization Gadgets
65RIESGO
abrir ↗
Nucleimedium
Piwigo - Cross-Site Scripting
CVE-2023-44393CRITICAL
Piwigo Reflected XSS vulnerability
43RIESGO
abrir ↗
Nucleicritical
JeecgBoot JimuReport - Template injection
CVE-2023-4450MEDIUM
jeecgboot JimuReport Template injection
53RIESGO
abrir ↗
Nucleimedium
Cockpit - Cross-Site Scripting
CVE-2023-4451MEDIUM
Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit
28RIESGO
abrir ↗
Nucleimedium
mooSocial v.3.1.8 - Cross-Site Scripting
CVE-2023-44812—
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a c
18RIESGO
abrir ↗
Nucleimedium
mooSocial v.3.1.8 - Cross-Site Scripting
CVE-2023-44813—
Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a c
18RIESGO
abrir ↗
Nucleihigh
WordPress Job Portal < 2.0.6 - SQL Injection
CVE-2023-4490CRITICAL
WP Job Portal < 2.0.6 - Unauthenticated SQLi
63RIESGO
abrir ↗
Nucleimedium
WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure
CVE-2023-44982MEDIUM
WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure
28RIESGO
abrir ↗
Nucleimedium
QNAP Music Station < 5.4.0 - Authentication Bypass
CVE-2023-45038MEDIUM
Music Station
28RIESGO
abrir ↗
Nucleimedium
XWiki < 14.10.14 - Cross-Site Scripting
CVE-2023-45136CRITICAL
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
43RIESGO
abrir ↗
Nucleicritical
Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE
CVE-2023-4521CRITICAL
Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE
75RIESGO
abrir ↗
Nucleihigh
PrestaShop PireosPay - SQL Injection
CVE-2023-45375—
In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL
30RIESGO
abrir ↗
Nucleicritical
D-Link DAR-8000-10 - Command Injection
CVE-2023-4542MEDIUM
D-Link DAR-8000-10 sys1.php os command injection
70RIESGO
abrir ↗
Nucleimedium
SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting
CVE-2023-4547LOW
SPA-Cart eCommerce CMS search cross site scripting
55RIESGO
abrir ↗
Nucleimedium
MooSocial 3.1.8 - Cross-Site Scripting
CVE-2023-45542—
Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a cra
18RIESGO
abrir ↗
Nucleimedium
Apache Tomcat - HTTP Request Smuggling
CVE-2023-45648MEDIUM
Apache Tomcat: Trailer header parsing too lenient
28RIESGO
abrir ↗
Nucleimedium
Frigate < 0.13.0 Beta 3 - Cross-Site Scripting
CVE-2023-45671MEDIUM
Frigate reflected XSS through `/<camera_name>` API endpoints
28RIESGO
abrir ↗
Nucleimedium
PaperCut NG Unauthenticated XMLRPC Functionality
CVE-2023-4568MEDIUM
PaperCut NG Unauthenticated XMLRPC
28RIESGO
abrir ↗
Nucleimedium
Leantime < 2.4 - Authenticated SQL Injection
CVE-2023-45826MEDIUM
Authenticated SQL Injection in leantime
28RIESGO
abrir ↗
Nucleicritical
Viessmann Vitogate 300 - Remote Code Execution
CVE-2023-45852—
In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute a
23RIESGO
abrir ↗
Nucleihigh
qdPM 9.2 - Directory Traversal
CVE-2023-45855—
qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.
18RIESGO
abrir ↗
Nucleicritical
Gibbon LMS <= v25.0.01 - File Upload to RCE
CVE-2023-45878—
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not
50RIESGO
abrir ↗
Nucleicritical
WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload
CVE-2023-4596CRITICAL
Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload
68RIESGO
abrir ↗
Nucleicritical
Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion
CVE-2023-4634CRITICAL
Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
85RIESGO
abrir ↗
Nucleicritical
PrestaShop Step by Step products Pack - SQL Injection
CVE-2023-46347CRITICAL
In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a
55RIESGO
abrir ↗
Nucleicritical
cPH2 Charging Station v1.87.0 - OS Command Injection
CVE-2023-46359CRITICAL
An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthen
65RIESGO
abrir ↗
Nucleihigh
GL.iNet <= 4.3.7 - Arbitrary File Write
CVE-2023-46455—
In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attac
30RIESGO
abrir ↗
Nucleicritical
TOTOLINK A3700R - Command Injection
CVE-2023-46574—
An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName p
30RIESGO
abrir ↗
← anteriorpágina 71 / 140siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.