Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
86.991 exploits
Exploit-DB
D-Link Routers - Plaintext Password
An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.
28RIESGO
abrir ↗Exploit-DB
Phoenix Contact WebVisit 2985725 - Authentication Bypass
The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism i
28RIESGO
abrir ↗Exploit-DB
SugarCRM 6.5.26 - Cross-Site Scripting
Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthentic
23RIESGO
abrir ↗Exploit-DB
D-Link Routers - Directory Traversal
Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L t
50RIESGO
abrir ↗Exploit-DB
D-Link Routers - Command Injection
An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02
60RIESGO
abrir ↗Metasploit300
Nuuo Central Management Server Authenticated Arbitrary File Download
NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be res
23RIESGO
abrir ↗Metasploit0
Nuuo Central Management Server Authenticated Arbitrary File Upload
NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite co
23RIESGO
abrir ↗Metasploit300
Nuuo Central Management Authenticated SQL Server SQLi
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can b
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious X
28RIESGO
abrir ↗Metasploit300
Nuuo Central Management Server User Session Token Bruteforce
NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
jQuery-File-Upload 9.22.0 - Arbitrary File Upload
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection
An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious
28RIESGO
abrir ↗Exploit-DB
Phoenix Contact WebVisit 6.40.00 - Password Disclosure
Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coinciden
23RIESGO
abrir ↗Exploit-DB
Ektron CMS 9.20 SP2 - Improper Access Restrictions
Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote at
28RIESGO
abrir ↗Exploit-DB
MicroTik RouterOS < 6.43rc3 - Remote Root
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RIESGO
abrir ↗Metasploit0
Windows NtUserSetWindowFNID Win32k User Callback
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
100RIESGO
abrir ↗Metasploit600
blueimp's jQuery (Arbitrary) File Upload
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RIESGO
abrir ↗Metasploit400
WebEx Local Service Permissions Exploit
Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability
61RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - 'BailOutOnInvalidatedArrayHeadSegment' Check Bypass
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RIESGO
abrir ↗Exploit-DB
Seqrite End Point Security 7.4 - Privilege Escalation
Seqrite End Point Security v7.4 has "Everyone: (F)" permission for %PROGRAMFILES%\Seqrite\Seqrite, which allows local us
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ghostscript - executeonly Bypass with errorhandler Setup
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving err
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Delta Electronics Delta Industrial Automation COMMGR 1.08 - Stack Buffer Overflow (Metasploit)
Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPS
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ifwatchd - Privilege Escalation (Metasploit)
/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arb
38RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - Type Confusion
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Unitrends UEB - HTTP API Remote Code Execution (Metasploit)
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, w
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Unitrends UEB - HTTP API Remote Code Execution (Metasploit)
It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Navigate CMS - (Unauthenticated) Remote Code Execution (Metasploit)
SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigat
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Zahir Enterprise Plus 6 - Stack Buffer Overflow (Metasploit)
Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute a
43RIESGO
abrir ↗Metasploit600
Imperva SecureSphere PWS Command Injection
A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.