Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados

40.452CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

86.991 exploits

Exploit-DB✓ VexDay Proof

Netgear Devices - (Unauthenticated) Remote Command Execution (Metasploit)

CVE-2016-1555CRITICALbajo ataqueremotehardware27 nov 2018

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear

100RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

Xorg X11 Server - SUID privilege escalation (Metasploit)

CVE-2018-14665—localmultiple26 nov 2018

A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh

43RIESGO

abrir ↗

Exploit-DB

Ticketly 1.0 - 'kind_id' SQL Injection

CVE-2018-18923—webappsphp26 nov 2018

AbiSoft Ticketly 1.0 is affected by multiple SQL Injection vulnerabilities through the parameters name, category_id and

23RIESGO

abrir ↗

GitHub PoC★ 1

The SSC REST API contains Insecure Direct Object Reference (IDOR) vulnerabilities in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10

CVE-2018-7690MEDIUM26 nov 2018

MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access

33RIESGO

abrir ↗

GitHub PoC★ 1

The SSC REST API contains Insecure Direct Object Reference (IDOR) vulnerabilities in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10

CVE-2018-7691MEDIUM26 nov 2018

MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access

33RIESGO

abrir ↗

GitHub PoC★ 15

RTSPServer Code Execution Vulnerability CVE-2018-4013

CVE-2018-4013CRITICAL24 nov 2018

An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server l

48RIESGO

abrir ↗

GitHub PoC★ 2

zeroto01/CVE-2018-14667

CVE-2018-14667CRITICALbajo ataque23 nov 2018

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2017-5638CRITICALbajo ataqueransomware22 nov 2018

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

abrir ↗

GitHub PoC★ 1

un4ckn0wl3z/CVE-2017-5638

CVE-2017-5638CRITICALbajo ataqueransomware22 nov 2018

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

abrir ↗

Exploit-DB

Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method)

CVE-2018-18955—locallinux21 nov 2018

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat

38RIESGO

abrir ↗

GitHub PoC

libSSH bypass

CVE-2018-10933CRITICAL21 nov 2018

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul

85RIESGO

abrir ↗

Exploit-DB

Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method)

CVE-2018-18955—locallinux21 nov 2018

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat

38RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

Microsoft Windows - DfMarshal Unsafe Unmarshaling Privilege Escalation

CVE-2018-8550—localwindows20 nov 2018

An elevation of privilege exists in Windows COM Aggregate Marshaler, aka "Windows COM Elevation of Privilege Vulnerabili

23RIESGO

abrir ↗

Exploit-DB

ImageMagick - Memory Leak

CVE-2018-16323—localmultiple19 nov 2018

ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that ha

35RIESGO

abrir ↗

GitHub PoC

tafamace/CVE-2016-0793

CVE-2016-0793—19 nov 2018

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Se

28RIESGO

abrir ↗

GitHub PoC

tafamace/CVE-2017-17485

CVE-2017-17485CRITICAL19 nov 2018

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because o

60RIESGO

abrir ↗

GitHub PoC

cve-2018-14667 demo

CVE-2018-14667CRITICALbajo ataque18 nov 2018

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

100RIESGO

abrir ↗

GitHub PoC★ 83

Tool for CVE-2018-16323

CVE-2018-16323—18 nov 2018

ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that ha

35RIESGO

abrir ↗

GitHub PoC★ 3

CVE-2018-16509 (Ghostscript contains multiple -dSAFER sandbox bypass vulnerabilities)

CVE-2018-16509—17 nov 2018

An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handlin

60RIESGO

abrir ↗

GitHub PoC

Implementation of CVE-2018-10933 with CIDR block scanner

CVE-2018-10933CRITICAL16 nov 2018

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul

85RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

Linux - Broken uid/gid Mapping for Nested User Namespaces

CVE-2018-18955—locallinux16 nov 2018

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat

38RIESGO

abrir ↗

Exploit-DB

DomainMOD 4.11.01 - 'raid' Cross-Site Scripting

CVE-2018-19136—webappsphp16 nov 2018

DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.

38RIESGO

abrir ↗

Exploit-DB

WordPress Plugin Ninja Forms 3.3.17 - Cross-Site Scripting

CVE-2018-19287—webappsphp15 nov 2018

XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes

38RIESGO

abrir ↗

Metasploit500

Linux Nested User Namespace idmap Limit Local Privilege Escalation

CVE-2018-18955—15 nov 2018

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat

38RIESGO

abrir ↗

Exploit-DB

PHP-Proxy 5.1.0 - Local File Inclusion

CVE-2018-19246—webappsphp15 nov 2018

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users w

28RIESGO

abrir ↗

Exploit-DB

Advanced Comment System 1.0 - SQL Injection

CVE-2018-18619—webappsphp14 nov 2018

internal/advanced_comment_system/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability bec

23RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

Dell OpenManage Network Manager 6.2.0.51 SP3 - Multiple Vulnerabilities

CVE-2018-15767—webappslinux14 nov 2018

Improper Authorization Vulnerability

28RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2018-19518—14 nov 2018

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh c

60RIESGO

abrir ↗

Metasploit600

Nagios XI Magpie_debug.php Root Remote Code Execution

CVE-2018-15710—14 nov 2018

Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.

50RIESGO

abrir ↗

Metasploit600

Nagios XI Magpie_debug.php Root Remote Code Execution

CVE-2018-15708—14 nov 2018

Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP r

60RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.