Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.836exploits catalogados

32.133CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8156Nuclei 4201Metasploit 3462✓ solo verificadosrecientes populares riesgo

4201 exploits

Nucleicritical

Lucee Admin - Remote Code Execution

CVE-2021-21307HIGH

Remote Code Exploit in Lucee Admin

78RIESGO

abrir ↗

Nucleihigh

Adminer <4.7.9 - Server-Side Request Forgery

CVE-2021-21311HIGHbajo ataque

SSRF in adminer

100RIESGO

abrir ↗

Nucleihigh

Node.JS System Information Library <5.3.1 - Remote Command Injection

CVE-2021-21315HIGHbajo ataque

Command Injection Vulnerability

100RIESGO

abrir ↗

Nucleicritical

XStream < 1.4.16 - Remote Code Execution

CVE-2021-21345MEDIUM

XStream is vulnerable to a Remote Command Execution attack

50RIESGO

abrir ↗

Nucleicritical

Oracle WebLogic Server - Remote Code Execution

CVE-2021-2135CRITICAL

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Suppor

43RIESGO

abrir ↗

Nucleicritical

XStream <1.4.16 - Remote Code Execution

CVE-2021-21351MEDIUM

XStream is vulnerable to an Arbitrary Code Execution attack

50RIESGO

abrir ↗

Nucleihigh

BuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Execution

CVE-2021-21389HIGH

BuddyPress privilege escalation via REST API

61RIESGO

abrir ↗

Nucleimedium

Jellyfin <10.7.0 - Local File Inclusion

CVE-2021-21402HIGH

Unauthenticated Arbitrary File Access in Jellyfin

78RIESGO

abrir ↗

Nucleicritical

SCIMono <0.0.19 - Remote Code Execution

CVE-2021-21479HIGH

In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availabi

41RIESGO

abrir ↗

Nucleimedium

ZTE MF971R - Referer authentication bypass

CVE-2021-21745—

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use th

30RIESGO

abrir ↗

Nucleimedium

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

CVE-2021-21799CRITICAL

Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (2

48RIESGO

abrir ↗

Nucleimedium

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

CVE-2021-21800CRITICAL

Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.1

48RIESGO

abrir ↗

Nucleimedium

Advantech R-SeeNet - Cross-Site Scripting

CVE-2021-21801CRITICAL

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web application

55RIESGO

abrir ↗

Nucleimedium

Advantech R-SeeNet - Cross-Site Scripting

CVE-2021-21802CRITICAL

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web application

43RIESGO

abrir ↗

Nucleicritical

WooCommerce Help Scout - Arbitrary File Upload

CVE-2021-24212—

WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE

18RIESGO

abrir ↗

Nucleimedium

GiveWP <= 2.9.7 - Cross-Site Scripting

CVE-2021-24213—

GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting

CVE-2021-24214—

OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error

18RIESGO

abrir ↗

Nucleicritical

Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation

CVE-2021-24215—

Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation

18RIESGO

abrir ↗

Nucleimedium

All Thrive Themes and Plugins - Unauthenticated Option Update

CVE-2021-24219—

All Thrive Themes and Plugins - Unauthenticated Option Update

18RIESGO

abrir ↗

Nucleicritical

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

CVE-2021-24220—

All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion

18RIESGO

abrir ↗

Nucleihigh

AccessAlly <3.5.7 - Sensitive Information Leakage

CVE-2021-24226—

AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage

18RIESGO

abrir ↗

Nucleihigh

Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion

CVE-2021-24227—

Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

18RIESGO

abrir ↗

Nucleimedium

WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting

CVE-2021-24235—

Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS

18RIESGO

abrir ↗

Nucleicritical

WordPress Imagements <=1.2.5 - Arbitrary File Upload

CVE-2021-24236—

Imagements <= 1.2.5 - Unauthenticated Arbitrary File Upload to RCE

18RIESGO

abrir ↗

Nucleimedium

WordPress Realteo <=1.2.3 - Cross-Site Scripting

CVE-2021-24237—

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress Pie Register <3.7.0.1 - Cross-Site Scripting

CVE-2021-24239—

Pie Register < 3.7.0.1 - Reflected Cross-Site Scripting (XSS)

18RIESGO

abrir ↗

Nucleimedium

WordPress Stop Spammers <2021.9 - Cross-Site Scripting

CVE-2021-24245—

Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)

38RIESGO

abrir ↗

Nucleimedium

WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting

CVE-2021-24274—

Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)

43RIESGO

abrir ↗

Nucleimedium

Popup by Supsystic <1.10.5 - Cross-Site scripting

CVE-2021-24275—

Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)

43RIESGO

abrir ↗

Nucleimedium

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

CVE-2021-24276—

Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)

43RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.