Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados

39.531CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientes populares riesgo

4478 exploits

Nucleicritical

Western Digital MyCloud NAS - Authentication Bypass

CVE-2018-17153—

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulne

40RIESGO

abrir ↗

Nucleicritical

LG Supersign EZ CMS - Remote Code Execution

CVE-2018-17173—

LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getT

50RIESGO

abrir ↗

Nucleicritical

WordPress Duplicator Plugin < 1.2.42 - Arbitrary Code Execution

CVE-2018-17207—

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and

30RIESGO

abrir ↗

Nucleicritical

Kibana - Local File Inclusion

CVE-2018-17246—

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with

60RIESGO

abrir ↗

Nucleicritical

Joomla! JCK Editor SQL Injection

CVE-2018-17254—

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.

60RIESGO

abrir ↗

Nucleihigh

Zoho ManageEngine OpManager - SQL Injection

CVE-2018-17283—

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as de

30RIESGO

abrir ↗

Nucleimedium

DotCMS < 5.0.2 - Open Redirect

CVE-2018-17422—

dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/

18RIESGO

abrir ↗

Nucleicritical

Comodo Unified Threat Management Web Console - Remote Code Execution

CVE-2018-17431—

Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication

60RIESGO

abrir ↗

Nucleimedium

WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting

CVE-2018-18069—

process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_fil

23RIESGO

abrir ↗

Nucleihigh

Kubernetes Dashboard <1.10.1 - Authentication Bypass

CVE-2018-18264—

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for rea

40RIESGO

abrir ↗

Nucleihigh

Centos Web Panel 0.9.8.480 - Local File Inclusion

CVE-2018-18323—

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/

60RIESGO

abrir ↗

Nucleihigh

DotNetNuke 9.2 - 9.2.2 - Weak Encryption & Cookie Deserialization

CVE-2018-18325HIGHbajo ataque

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue ex

100RIESGO

abrir ↗

Nucleimedium

Planon <Live Build 41 - Cross-Site Scripting

CVE-2018-18570—

Planon before Live Build 41 has XSS.

18RIESGO

abrir ↗

Nucleimedium

DedeCMS 5.7 SP2 - Cross-Site Scripting

CVE-2018-18608—

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is u

18RIESGO

abrir ↗

Nucleimedium

Microstrategy Web 7 - Cross-Site Scripting

CVE-2018-18775—

Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (

38RIESGO

abrir ↗

Nucleimedium

Microstrategy Web 7 - Local File Inclusion

CVE-2018-18777—

Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subp

43RIESGO

abrir ↗

Nucleimedium

ACME mini_httpd <1.30 - Local File Inclusion

CVE-2018-18778—

ACME mini_httpd before 1.30 lets remote users read arbitrary files.

40RIESGO

abrir ↗

Nucleimedium

TIBCO JasperReports Library - Directory Traversal

CVE-2018-18809CRITICALbajo ataque

TIBCO JasperReports Library Directory Traversal Vulnerability

100RIESGO

abrir ↗

Nucleicritical

Gogs (Go Git Service) 0.11.66 - Remote Code Execution

CVE-2018-18925—

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." s

30RIESGO

abrir ↗

Nucleicritical

PHPCMS 2008 - Remote Code Execution via Template Injection

CVE-2018-19127—

A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cach

23RIESGO

abrir ↗

Nucleimedium

DomainMOD 4.11.01 - Cross-Site Scripting

CVE-2018-19136—

DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.

38RIESGO

abrir ↗

Nucleimedium

DomainMOD 4.11.01 - Cross-Site Scripting

CVE-2018-19137—

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.

18RIESGO

abrir ↗

Nucleicritical

WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option

CVE-2018-19207—

The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to exe

60RIESGO

abrir ↗

Nucleicritical

OpenMRS Platform < 2.24.0 - Insecure Object Deserialization

CVE-2018-19276CRITICAL

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated use

85RIESGO

abrir ↗

Nucleimedium

WordPress Ninja Forms <3.3.18 - Cross-Site Scripting

CVE-2018-19287—

XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes

38RIESGO

abrir ↗

Nucleihigh

Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion

CVE-2018-19326—

Zyxel VMG1312-B10D devices before 5.13(AAXA.8)C0 allow ../ Directory Traversal, as demonstrated by reading /etc/passwd.

18RIESGO

abrir ↗

Nucleicritical

Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal

CVE-2018-19365—

The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via

23RIESGO

abrir ↗

Nucleimedium

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting

CVE-2018-19386—

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component,

18RIESGO

abrir ↗

Nucleihigh

Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution

CVE-2019-0232—

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RIESGO

abrir ↗

Nucleihigh

Jenkins Script Security Plugin <=1.49 - Sandbox Bypass

CVE-2019-1003000—

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/

60RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.