Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
86.991 exploits
Exploit-DB
Cisco Umbrella Roaming Client 2.0.168 - Local Privilege Escalation
Cisco Umbrella Enterprise Roaming Client Privilege Escalation Vulnerability
23RIESGO
abrir ↗Exploit-DB
Jorani Leave Management 0.6.5 - Cross-Site Scripting
Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HT
38RIESGO
abrir ↗Exploit-DB
Apache Roller 5.0.3 - XML External Entity Injection (File Disclosure)
The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks
28RIESGO
abrir ↗Exploit-DB
Tenda ADSL Router D152 - Cross-Site Scripting
Tenda D152 ADSL routers allow XSS via a crafted SSID.
23RIESGO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RIESGO
abrir ↗GitHub PoC★ 2
Apache Struts version analyzer (Ansible) based on CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RIESGO
abrir ↗GitHub PoC★ 5
A remote code execution exploit for WebLogic based on CVE-2018-2628
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RIESGO
abrir ↗GitHub PoC★ 25
CVE-2017-10366: Oracle PeopleSoft 8.54, 8.55, 8.56 Java deserialization exploit
Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Perform
35RIESGO
abrir ↗GitHub PoC★ 95
Primefaces <= 5.2.21, 5.3.8 or 6.0 - Remote Code Execution Exploit
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RIESGO
abrir ↗Exploit-DB
FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection
FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.
23RIESGO
abrir ↗VulnCheck XDB
initial-access
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RIESGO
abrir ↗Exploit-DB
D-Link DIR-615 - Denial of Service (PoC)
D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.
35RIESGO
abrir ↗Exploit-DB
DamiCMS 6.0.0 - Cross-Site Request Forgery (Change Admin Password)
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's pas
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Network Manager VPNC 1.2.6 - 'Username' Local Privilege Escalation (Metasploit)
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attac
56RIESGO
abrir ↗Exploit-DB
DLink DIR-601 - Credential Disclosure
An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (whi
45RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cybrotech CyBroHttpServer 1.0.3 - Cross-Site Scripting
Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
50RIESGO
abrir ↗GitHub PoC★ 13
Mitigate CVE-2018-6389 WordPress load-scripts / load-styles attacks
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the
45RIESGO
abrir ↗GitHub PoC★ 56
This tool takes advantage of CVE-2018-11776 and Shodan to perform mass exploitation of verified and vulnerable Apache Struts servers.
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗Metasploit0
Snap Creek Duplicator WordPress plugin code injection
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and
30RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
phpMyAdmin 4.7.x - Cross-Site Request Forgery
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Argus Surveillance DVR 4.0.0.0 - Directory Traversal
Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F
60RIESGO
abrir ↗GitHub PoC★ 2
Tiny script to enumerate users using CVE-2017-9554 (forget_passwd.cgi)
An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allo
60RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗VulnCheck XDB
initial-access
An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allo
60RIESGO
abrir ↗GitHub PoC★ 16
A simple exploit for Apache Struts RCE S2-057 (CVE-2018-11776)
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - JScript RegExp.lastIndex Use-After-Free
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet
35RIESGO
abrir ↗GitHub PoC★ 3
tuxotron/cve-2018-11776-docker
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.