Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
86.991 exploits
Metasploit300
WebKitGTK+ WebKitFaviconDatabase DoS
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon
50RIESGO
abrir ↗GitHub PoC★ 6
MS Word MS WordPad via IE VBS Engine RCE
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
93RIESGO
abrir ↗VulnCheck XDB
client-side
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
93RIESGO
abrir ↗GitHub PoC
My version - [Win10 x64] CloudMe-Sync-1.10.9-Buffer-Overflow-SEH-DEP-Bypass CVE-2018-6892
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RIESGO
abrir ↗GitHub PoC
My version - CloudMe-Sync-1.10.9---Buffer-Overflow-SEH-DEP-Bypass on Win7 x64 CVE-2018-6892
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - EntrySimpleObjectSlotGetter Type Confusion
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RIESGO
abrir ↗Metasploit600
Quest KACE Systems Management Command Injection
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
100RIESGO
abrir ↗GitHub PoC★ 9
Tools to exercise the Linux kernel mitigation for CVE-2018-3639 (aka Variant 4) using the Speculative Store Bypass Disable (SSBD) feature of x86 processors
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
45RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass
An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path fr
28RIESGO
abrir ↗Exploit-DB
Procps-ng - Multiple Vulnerabilities
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection
28RIESGO
abrir ↗VulnCheck XDB
client-side
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
93RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass
An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.
23RIESGO
abrir ↗Exploit-DB
Procps-ng - Multiple Vulnerabilities
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset
41RIESGO
abrir ↗Exploit-DB
Siemens SIMATIC S7-300 CPU - Remote Denial of Service
Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via craf
53RIESGO
abrir ↗Metasploit300
Dolibarr Gather Credentials via SQL Injection
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vecto
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Dolibarr ERP/CRM 7.0.0 - (Authenticated) SQL Injection
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vecto
50RIESGO
abrir ↗Exploit-DB
Procps-ng - Multiple Vulnerabilities
procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() return
28RIESGO
abrir ↗Exploit-DB
Procps-ng - Multiple Vulnerabilities
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory
28RIESGO
abrir ↗Exploit-DB
Procps-ng - Multiple Vulnerabilities
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec
41RIESGO
abrir ↗GitHub PoC★ 138
CVE-2018-8174_python
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
93RIESGO
abrir ↗Exploit-DB
SearchBlox 8.6.6 - Cross-Site Request Forgery
servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST param
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass
An issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically
23RIESGO
abrir ↗Exploit-DB
NUUO NVRmini2 / NVRsolo - Arbitrary File Upload
upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.
23RIESGO
abrir ↗Exploit-DB
Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection
An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.
23RIESGO
abrir ↗Exploit-DB
MyBB ChangUonDyU Plugin 1.0.2 - Cross-Site Scripting
An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonst
23RIESGO
abrir ↗Exploit-DB
DomainMod 4.09.03 - 'sslpaid' Cross-Site Scripting
DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.
23RIESGO
abrir ↗Exploit-DB
wityCMS 0.6.1 - Cross-Site Scripting
Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "Ge
23RIESGO
abrir ↗Metasploit600
IBM QRadar SIEM Unauthenticated Remote Code Execution
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM
50RIESGO
abrir ↗Metasploit600
IBM QRadar SIEM Unauthenticated Remote Code Execution
IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be r
43RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.