Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.886exploits catalogados

32.153CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8176Nuclei 4202Metasploit 3462✓ solo verificadosrecientes populares riesgo

4202 exploits

Nucleihigh

Schneider Electric U.motion Builder - SQL Injection

CVE-2018-7765—

The vulnerability exists within processing of track_import_export.php in Schneider Electric U.motion Builder software ve

18RIESGO

abrir ↗

Nucleicritical

Schneider Electric U.motion Builder - Remote Code Execution

CVE-2018-7841CRITICALbajo ataque

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code

100RIESGO

abrir ↗

Nucleimedium

Apache ActiveMQ <=5.15.5 - Cross-Site Scripting

CVE-2018-8006—

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console

30RIESGO

abrir ↗

Nucleimedium

Apache Spark UI - Cross-Site Scripting

CVE-2018-8024—

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointin

18RIESGO

abrir ↗

Nucleihigh

Apache OFBiz - XML External Entity Injection

CVE-2018-8033—

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles re

23RIESGO

abrir ↗

Nucleihigh

AppWeb - Authentication Bypass

CVE-2018-8715—

The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in

23RIESGO

abrir ↗

Nucleimedium

WordPress WP Security Audit Log 3.1.1 - Information Disclosure

CVE-2018-8719—

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-securit

43RIESGO

abrir ↗

Nucleihigh

Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion

CVE-2018-8727—

Path Traversal in Gateway in Mirasys DVMS Workstation 5.12.6 and earlier allows an attacker to traverse the file system

18RIESGO

abrir ↗

Nucleimedium

Cobub Razor 0.8.0 - Information Disclosure

CVE-2018-8770—

Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, contro

50RIESGO

abrir ↗

Nucleicritical

PrestaShop Responsive Mega Menu Module - Remote Code Execution

CVE-2018-8823—

modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for Pre

30RIESGO

abrir ↗

Nucleihigh

WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion

CVE-2018-9118—

exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Direct

50RIESGO

abrir ↗

Nucleicritical

PrismaWEB - Credentials Disclosure

CVE-2018-9161—

Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the

30RIESGO

abrir ↗

Nucleihigh

Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion

CVE-2018-9205—

Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.

50RIESGO

abrir ↗

Nucleicritical

Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload

CVE-2018-9206—

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

60RIESGO

abrir ↗

Nucleicritical

Etherpad Lite <1.6.4 - Admin Authentication Bypass

CVE-2018-9845—

Etherpad Lite before 1.6.4 is exploitable for admin access.

23RIESGO

abrir ↗

Nucleicritical

TBK DVR4104/DVR4216 Devices - Authentication Bypass

CVE-2018-9995—

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L

60RIESGO

abrir ↗

Nucleicritical

ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)

CVE-2019-10647—

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/con

18RIESGO

abrir ↗

Nucleicritical

Apache Solr - Deserialization of Untrusted Data

CVE-2019-0192—

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP

60RIESGO

abrir ↗

Nucleihigh

Apache Solr DataImportHandler <8.2.0 - Remote Code Execution

CVE-2019-0193HIGHbajo ataque

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources,

100RIESGO

abrir ↗

Nucleimedium

Apache Tomcat - Cross-Site Scripting

CVE-2019-0221—

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided

50RIESGO

abrir ↗

Nucleicritical

Apache Struts <=2.5.20 - Remote Code Execution

CVE-2019-0230—

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

60RIESGO

abrir ↗

Nucleihigh

Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution

CVE-2019-0232—

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RIESGO

abrir ↗

Nucleihigh

Jenkins Script Security Plugin <=1.49 - Sandbox Bypass

CVE-2019-1003000—

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/

60RIESGO

abrir ↗

Nucleicritical

Kentico CMS Insecure Deserialization Remote Code Execution

CVE-2019-10068CRITICALbajo ataque

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions

100RIESGO

abrir ↗

Nucleimedium

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting

CVE-2019-10092—

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page

60RIESGO

abrir ↗

Nucleimedium

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect

CVE-2019-10098—

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential m

60RIESGO

abrir ↗

Nucleimedium

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting

CVE-2019-1010287—

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to ex

18RIESGO

abrir ↗

Nucleimedium

Babel - Open Redirect

CVE-2019-1010290—

Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is sup

18RIESGO

abrir ↗

Nucleicritical

Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection

CVE-2019-10232—

Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.

23RIESGO

abrir ↗

Nucleimedium

Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export

CVE-2019-17228—

includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin

18RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.