Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB
Blog Master Pro 1.0 - CSV Injection
CVE-2018-10255—webappsphp25 abr 2018
A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level pri
23RIESGO
abrir ↗
Exploit-DB
HRSALE The Ultimate HRM 1.0.2 - CSV Injection
CVE-2018-10257—webappsphp25 abr 2018
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile
23RIESGO
abrir ↗
Exploit-DB
Shopy Point of Sale 1.0 - CSV Injection
CVE-2018-10258—webappsphp25 abr 2018
A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Adobe Flash - Out-of-Bounds Write in blur Filtering
CVE-2018-4937—dosmultiple24 abr 2018
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exp
28RIESGO
abrir ↗
Exploit-DB
Open-AudIT 2.1 - CSV Macro Injection
CVE-2018-9137—webappswindows24 abr 2018
Open-AudIT before 2.2 has CSV Injection.
23RIESGO
abrir ↗
Exploit-DB
Easy File Sharing Web Server 7.2 - 'UserID' Remote Buffer Overflow (DEP Bypass)
CVE-2018-9059—remotewindows24 abr 2018
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code
60RIESGO
abrir ↗
Exploit-DB
UK Cookie Consent - Persistent Cross-Site Scripting
CVE-2018-10310—webappsphp24 abr 2018
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Conse
23RIESGO
abrir ↗
Exploit-DB
Monstra CMS 3.0.4 - Arbitrary Folder Deletion
CVE-2018-9038—webappsphp24 abr 2018
Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&delete_dir=./&path=uplo
23RIESGO
abrir ↗
Exploit-DB
Ericsson-LG iPECS NMS A.1Ac - Cleartext Credential Disclosure
CVE-2018-10285—webappsphp24 abr 2018
The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Adobe Flash - Overflow when Playing Sound
CVE-2018-4936—dosmultiple24 abr 2018
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploitat
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Adobe Flash - Info Leak in Image Inflation
CVE-2018-4934—dosmultiple24 abr 2018
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful expl
28RIESGO
abrir ↗
Exploit-DB
Interspire Email Marketer < 6.1.6 - Remote Admin Authentication Bypass
CVE-2017-14322—webappsphp24 abr 2018
The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior
35RIESGO
abrir ↗
Exploit-DB
WSO2 Carbon / WSO2 Dashboard Server 5.3.0 - Persistent Cross-Site Scripting
CVE-2018-8716—webappsjava24 abr 2018
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
35RIESGO
abrir ↗
Exploit-DB
Ericsson-LG iPECS NMS A.1Ac - Cleartext Credential Disclosure
CVE-2018-9245—webappsphp24 abr 2018
The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that a
23RIESGO
abrir ↗
Exploit-DB
WUZHI CMS 4.1.0 - Cross-Site Request Forgery
CVE-2018-10312—webappsphp24 abr 2018
index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.
23RIESGO
abrir ↗
Exploit-DB
VLC Media Player/Kodi/PopcornTime 'Red Chimera' < 2.2.5 - Memory Corruption (PoC)
CVE-2017-8311—doswindows24 abr 2018
Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an inpu
23RIESGO
abrir ↗
Exploit-DB
Ericsson-LG iPECS NMS A.1Ac - Cleartext Credential Disclosure
CVE-2018-10286—webappsphp24 abr 2018
The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and th
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Adobe Flash - Overflow in Slab Rendering
CVE-2018-4935—dosmultiple24 abr 2018
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exp
28RIESGO
abrir ↗
Exploit-DB
Microsoft Windows - Local Privilege Escalation
CVE-2018-1038—localwindows24 abr 2018
The Windows kernel in Windows 7 SP1 and Windows Server 2008 R2 SP1 allows an elevation of privilege vulnerability due to
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
ASUS infosvr - Authentication Bypass Command Execution (Metasploit)
CVE-2014-9583—remotehardware24 abr 2018
common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC
60RIESGO
abrir ↗
Exploit-DB
Ncomputing vSpace Pro 10/11 - Directory Traversal
CVE-2018-10201—webappswindows23 abr 2018
An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible t
50RIESGO
abrir ↗
Exploit-DB
phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery
CVE-2018-10188—webappsphp23 abr 2018
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_ope
23RIESGO
abrir ↗
Exploit-DB
PRTG Network Monitor < 18.1.39.1648 - Stack Overflow (Denial of Service)
CVE-2018-10253—doswindows_x8623 abr 2018
Paessler PRTG Network Monitor before 18.1.39.1648 mishandles stack memory during unspecified API calls.
23RIESGO
abrir ↗
Exploit-DB
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
CVE-2017-12635—webappslinux23 abr 2018
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be
60RIESGO
abrir ↗
Exploit-DB
Monstra cms 3.0.4 - Persitent Cross-Site Scripting
CVE-2018-10109—webappsphp23 abr 2018
Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload
23RIESGO
abrir ↗
Exploit-DB
Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure
CVE-2018-9205—webappsphp23 abr 2018
Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.
50RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Oracle Weblogic Server 10.3.6.0 / 12.1.3.0 / 12.2.1.2 / 12.2.1.3 - Deserialization Remote Command Execution
CVE-2018-2628CRITICALbajo ataqueremotemultiple22 abr 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RIESGO
abrir ↗
Exploit-DB
Cobub Razor 0.8.0 - Physical Path Leakage
CVE-2018-8770—webappsphp20 abr 2018
Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, contro
50RIESGO
abrir ↗
Exploit-DB
Cobub Razor 0.8.0 - Physical Path Leakage
CVE-2018-8056—webappsphp20 abr 2018
Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channel_name parameter to /index.php?/ma
28RIESGO
abrir ↗
Exploit-DB
Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities
CVE-2018-10078—webappsxml18 abr 2018
Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to i
23RIESGO
abrir ↗
← anteriorpágina 101 / 817siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.