Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
86.991 exploits
GitHub PoC★ 2
This Python 3 script is for uploading shell (and other files) to Windows Server / Linux via Oracle 11g R2 (CVE-2010-3600).
CVE-2010-3600—20 jul 2018
Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and En
60RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2018-2894—20 jul 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Su
50RIESGO
abrir ↗
Exploit-DB
Touchpad / Trivum WebTouch Setup 2.53 build 13163 - Authentication Bypass
CVE-2018-13862—webappshardware20 jul 2018
Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) allow unauthorized remote attacker
35RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2018-2894—19 jul 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Su
50RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Linux - BPF Sign Extension Local Privilege Escalation (Metasploit)
CVE-2017-16995—locallinux19 jul 2018
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial
50RIESGO
abrir ↗
Exploit-DB
WordPress Plugin All In One Favicon 4.6 - (Authenticated) Cross-Site Scripting
CVE-2018-13832—webappsphp19 jul 2018
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plu
23RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2018-2893—19 jul 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
60RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2018-2893—19 jul 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
60RIESGO
abrir ↗
Exploit-DB
MyBB New Threads Plugin 1.1 - Cross-Site Scripting
CVE-2018-14392—webappsphp19 jul 2018
The New Threads plugin before 1.2 for MyBB has XSS.
35RIESGO
abrir ↗
Exploit-DB
Open-AudIT Community 2.1.1 - Cross-Site Scripting
CVE-2018-11124—webappsmultiple18 jul 2018
Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows
23RIESGO
abrir ↗
Metasploit300
Eaton Xpert Meter SSH Private Key Exposure Scanner
CVE-2018-16158—18 jul 2018
Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different cus
30RIESGO
abrir ↗
GitHub PoC
likekabin/CVE-2018-4121
CVE-2018-4121—17 jul 2018
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud b
28RIESGO
abrir ↗
GitHub PoC
likekabin/ShareDoc_cve-2015-5477
CVE-2015-5477HIGHbajo ataque17 jul 2018
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (
100RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Nanopool Claymore Dual Miner - APIs Remote Code Execution (Metasploit)
CVE-2018-1000049—remotemultiple17 jul 2018
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
CVE-2018-0707—remotelinux17 jul 2018
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
50RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
CVE-2018-0706—remotelinux17 jul 2018
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
50RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Linux (Ubuntu) - Other Users coredumps Can Be Read via setgid Directory and killpriv Bypass
CVE-2018-13405—doslinux16 jul 2018
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Fortify Software Security Center (SSC) 17.x/18.1 - XML External Entity Injection
CVE-2018-12463HIGHwebappsjava16 jul 2018
MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities
46RIESGO
abrir ↗
GitHub PoC★ 50
Collection of exploits/POC for PrestaShop cookie vulnerabilities (CVE-2018-13784)
CVE-2018-13784—16 jul 2018
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfi
28RIESGO
abrir ↗
Exploit-DB
PrestaShop < 1.6.1.19 - 'AES CBC' Privilege Escalation
CVE-2018-13784—webappsphp16 jul 2018
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfi
28RIESGO
abrir ↗
Exploit-DB
PrestaShop < 1.6.1.19 - 'BlowFish ECD' Privilege Escalation
CVE-2018-13784—webappsphp16 jul 2018
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfi
28RIESGO
abrir ↗
Exploit-DB
VelotiSmart WiFi B-380 Camera - Directory Traversal
CVE-2018-14064—webappshardware16 jul 2018
The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../..
50RIESGO
abrir ↗
VulnCheck XDB
remote-with-credentials
CVE-2018-2380MEDIUMbajo ataqueransomware13 jul 2018
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information pr
68RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Apache CouchDB - Arbitrary Command Execution (Metasploit)
CVE-2017-12636—remotelinux13 jul 2018
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include pa
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
CVE-2018-0710—webappshardware13 jul 2018
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authe
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
CVE-2018-0706—webappshardware13 jul 2018
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
50RIESGO
abrir ↗
Exploit-DB
Zeta Producer Desktop CMS 14.2.0 - Remote Code Execution / Local File Disclosure
CVE-2018-13981—webappsphp13 jul 2018
The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WAGO e!DISPLAY 7300T - Multiple Vulnerabilities
CVE-2018-12979—webappsphp13 jul 2018
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WAGO e!DISPLAY 7300T - Multiple Vulnerabilities
CVE-2018-12981—webappsphp13 jul 2018
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerabilit
23RIESGO
abrir ↗
Exploit-DB
G DATA Total Security 25.4.0.3 - Activex Buffer Overflow
CVE-2018-10018—doswindows13 jul 2018
The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a lo
23RIESGO
abrir ↗
← anteriorpágina 1025 / 2900siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.