Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
86.991 exploits
Exploit-DB
FreshRSS 1.11.1 - Cross-Site Scripting
CVE-2018-19782—webappsphp04 dic 2018
Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject
23RIESGO
abrir ↗
Exploit-DB
Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass
CVE-2018-19616—webappshardware04 dic 2018
An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/rem
35RIESGO
abrir ↗
GitHub PoC
CVE-2014-8682
CVE-2014-8682—04 dic 2018
Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow r
50RIESGO
abrir ↗
GitHub PoC
This is an exploitation guide for CVE-2016-2233
CVE-2016-2233—03 dic 2018
Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC serve
35RIESGO
abrir ↗
VulnCheck XDB
remote-with-credentials
CVE-2016-0728—03 dic 2018
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref
23RIESGO
abrir ↗
Exploit-DB
Apache Superset < 0.23 - Remote Code Execution
CVE-2018-8021—webappslinux03 dic 2018
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to pos
35RIESGO
abrir ↗
GitHub PoC★ 1
A collection of code pertaining to CVE-2016-0728 (various authors)
CVE-2016-0728—03 dic 2018
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref
23RIESGO
abrir ↗
GitHub PoC
CVE-2014-4511
CVE-2014-4511—03 dic 2018
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in
60RIESGO
abrir ↗
GitHub PoC
A VENOM (CVE-2015-3456) Exploit / PoC written in C.
CVE-2015-3456—03 dic 2018
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
28RIESGO
abrir ↗
Exploit-DB
CyberArk 9.7 - Memory Disclosure
CVE-2018-9842—remotewindows03 dic 2018
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
28RIESGO
abrir ↗
GitHub PoC
CVE-2016-1240 exploit and patch
CVE-2016-1240—02 dic 2018
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia
38RIESGO
abrir ↗
GitHub PoC★ 104
CVE-2018-8021 Proof-Of-Concept and Exploit
CVE-2018-8021—02 dic 2018
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to pos
35RIESGO
abrir ↗
GitHub PoC★ 39
PrestaShop (1.6.x <= 1.6.1.23 or 1.7.x <= 1.7.4.4) Back Office Remote Code Execution (CVE-2018-19126)
CVE-2018-19126—01 dic 2018
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file u
28RIESGO
abrir ↗
Exploit-DB
xorg-x11-server < 1.20.3 - 'modulepath' Local Privilege Escalation
CVE-2018-14665—localmultiple30 nov 2018
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RIESGO
abrir ↗
VulnCheck XDB
client-side
CVE-2018-14667CRITICALbajo ataque30 nov 2018
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou
100RIESGO
abrir ↗
Exploit-DB
PhpSpreadsheet < 1.5.0 - XML External Entity (XXE)
CVE-2018-19277—webappsphp30 nov 2018
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 enco
23RIESGO
abrir ↗
Exploit-DB
Schneider Electric PLC - Session Calculation Authentication Bypass
CVE-2017-6026—webappshardware30 nov 2018
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware ver
35RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
VBScript - 'OLEAUT32!VariantClear' and 'scrrun!VBADictionary::put_Item' Use-After-Free
CVE-2018-8544—doswindows30 nov 2018
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
35RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
VBScript - 'rtFilter' Out-of-Bounds Read
CVE-2018-8552—doswindows30 nov 2018
An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which coul
35RIESGO
abrir ↗
GitHub PoC★ 50
All about CVE-2018-14667; From what it is to how to successfully exploit it.
CVE-2018-14667CRITICALbajo ataque30 nov 2018
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou
100RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Mac OS X - libxpc MITM Privilege Escalation (Metasploit)
CVE-2018-4237—localmacos29 nov 2018
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
43RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Linux - Nested User Namespace idmap Limit Local Privilege Escalation (Metasploit)
CVE-2018-18955—locallinux29 nov 2018
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat
38RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WebKit JIT - 'ByteCodeParser::handleIntrinsicCall' Type Confusion
CVE-2018-4382—dosmultiple29 nov 2018
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iO
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
PHP imap_open - Remote Code Execution (Metasploit)
CVE-2018-19518—remotelinux29 nov 2018
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh c
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the 'ForInContext' Object
CVE-2018-4386—dosmultiple29 nov 2018
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iO
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WebKit JSC JIT - 'JSPropertyNameEnumerator' Type Confusion
CVE-2018-4416—dosmultiple29 nov 2018
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iO
35RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Unitrends Enterprise Backup - bpserverd Privilege Escalation (Metasploit)
CVE-2018-6329—locallinux29 nov 2018
It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL i
50RIESGO
abrir ↗
GitHub PoC★ 1
about CVE-2018-14667 from RichFaces Framework 3.3.4
CVE-2018-14667CRITICALbajo ataque28 nov 2018
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou
100RIESGO
abrir ↗
GitHub PoC
lol-fi/cve-2011-4862
CVE-2011-4862—28 nov 2018
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka k
60RIESGO
abrir ↗
VulnCheck XDB
remote-with-credentials
CVE-2018-19207—27 nov 2018
The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to exe
60RIESGO
abrir ↗
← anteriorpágina 1005 / 2900siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.