Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.836exploits catalogados
32.133CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8156Nuclei 4201Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4193 exploits
Nucleimedium
Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Scripting
CVE-2024-3822MEDIUM
Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS
28RIESGO
abrir ↗
Nucleihigh
TurboMeeting - Post-Authentication Command Injection
CVE-2024-38288HIGH
A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allow
36RIESGO
abrir ↗
Nucleicritical
TurboMeeting - Boolean-based SQL Injection
CVE-2024-38289CRITICAL
A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x all
55RIESGO
abrir ↗
Nucleimedium
CodiMD <2.5.4 - Insecure Filename Randomization
CVE-2024-38353MEDIUM
CodiMD - Missing Image Access Controls and Unauthorized Image Access
28RIESGO
abrir ↗
Nucleihigh
Apache HTTPd Windows UNC - Server-Side Request Forgery
CVE-2024-38472HIGH
Apache HTTP Server on WIndows UNC SSRF
48RIESGO
abrir ↗
Nucleihigh
Apache HTTP Server - ACL Bypass
CVE-2024-38473HIGH
Apache HTTP Server proxy encoding problem
41RIESGO
abrir ↗
Nucleicritical
Sonicwall - Pre-Authentication Arbitrary File Read
CVE-2024-38475CRITICALbajo ataque
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
100RIESGO
abrir ↗
Nucleihigh
Mlflow < 2.11.0 - Path Traversal
CVE-2024-3848HIGH
Path Traversal Bypass in mlflow/mlflow
48RIESGO
abrir ↗
Nucleimedium
Uniview NVR301-04S2-P4 - Cross-Site Scripting
CVE-2024-3850MEDIUM
Uniview NVR301-04S2-P4 Cross-site Scripting
28RIESGO
abrir ↗
Nucleihigh
NextChat - Server-Side Request Forgery
CVE-2024-38514HIGH
NextChat Server-Side Request Forgery (SSRF)
36RIESGO
abrir ↗
Nucleihigh
Ivanti Avalanche SmartDeviceServer - XML External Entity
CVE-2024-38653HIGH
XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on t
58RIESGO
abrir ↗
Nucleicritical
FormLift for Infusionsoft Web Forms <= 7.5.17 - SQL Injection
CVE-2024-38773CRITICAL
WordPress formlift plugin <= 7.5.17 - Unauthenticated Blind SQL Injection vulnerability
43RIESGO
abrir ↗
Nucleihigh
WebMvc.fn/WebFlux.fn - Path Traversal
CVE-2024-38816HIGH
CVE-2024-38816: Path traversal vulnerability in functional web frameworks
61RIESGO
abrir ↗
Nucleihigh
Spring Framework Path Traversal in Functional Web Frameworks
CVE-2024-38819HIGH
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to pa
48RIESGO
abrir ↗
Nucleicritical
Apache OFBiz - Improper Authorization & Remote Code Execution
CVE-2024-38856HIGHbajo ataque
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
100RIESGO
abrir ↗
Nucleicritical
Dokan Pro <= 3.10.3 - SQL Injection
CVE-2024-3922CRITICAL
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
75RIESGO
abrir ↗
Nucleihigh
EfroTech Timetrax v8.3 - Sql Injection
CVE-2024-39250CRITICAL
EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in t
63RIESGO
abrir ↗
Nucleihigh
WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS
CVE-2024-39646HIGH
WordPress Custom 404 Pro plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability
36RIESGO
abrir ↗
Nucleihigh
Rocket.Chat - Server-Side Request Forgery (SSRF)
CVE-2024-39713HIGH
A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.
56RIESGO
abrir ↗
Nucleimedium
Apache Superset < 4.0.2 - SQL Injection
CVE-2024-39887MEDIUM
Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
28RIESGO
abrir ↗
Nucleihigh
Solara <1.35.1 - Local File Inclusion
CVE-2024-39903HIGH
Local File Inclusion in Solara
36RIESGO
abrir ↗
Nucleicritical
1Panel SQL Injection - Authenticated
CVE-2024-39907CRITICAL
a sqlinjection in 1Panel
48RIESGO
abrir ↗
Nucleicritical
FOG Project < 1.5.10.34 - Remote Command Execution
CVE-2024-39914CRITICAL
FOG has a command injection in /fog/management/export.php?filename=
68RIESGO
abrir ↗
Nucleihigh
Bazarr < 1.4.3 - Arbitrary File Read
CVE-2024-40348HIGH
An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory
36RIESGO
abrir ↗
Nucleicritical
CrushFTP VFS - Sandbox Escape LFR
CVE-2024-4040CRITICALbajo ataque
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RIESGO
abrir ↗
Nucleicritical
Devika v1 - Path Traversal
CVE-2024-40422CRITICAL
The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path tr
68RIESGO
abrir ↗
Nucleicritical
Veeam Backup & Replication - Unauthenticated
CVE-2024-40711CRITICALbajo ataqueransomware
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec
100RIESGO
abrir ↗
Nucleicritical
Apache CloudStack - SAML Signature Exclusion
CVE-2024-41107HIGH
Apache CloudStack: SAML Signature Exclusion
41RIESGO
abrir ↗
Nucleihigh
Cluster Control CMON API - Directory Traversal
CVE-2024-41628HIGH
Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and
36RIESGO
abrir ↗
Nucleihigh
OpenAM<=15.0.3 FreeMarker - Template Injection
CVE-2024-41667HIGH
OpenAM FreeMarker template injection
36RIESGO
abrir ↗
← anteriorpágina 84 / 140siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.