Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
86.991 exploits
Exploit-DB
iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting
CVE-2018-9236—webappsphp10 abr 2018
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.
23RIESGO
abrir ↗
Exploit-DB
WUZHI CMS 4.1.0 - Cross-Site Request Forgery (Add Admin)
CVE-2018-9926—webappsphp10 abr 2018
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=
23RIESGO
abrir ↗
Exploit-DB
iScripts SonicBB 1.0 - Reflected Cross-Site Scripting (PoC)
CVE-2018-9235—webappsphp09 abr 2018
iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.
23RIESGO
abrir ↗
Exploit-DB
CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure
CVE-2018-9842—doslinux09 abr 2018
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
28RIESGO
abrir ↗
Exploit-DB
Yahei PHP Prober 0.4.7 - Cross-Site Scripting
CVE-2018-9238—webappsphp09 abr 2018
proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.
23RIESGO
abrir ↗
Exploit-DB
WolfCMS 0.8.3.1 - Open Redirection
CVE-2018-8813—webappsphp09 abr 2018
Open redirect vulnerability in the login[redirect] parameter login functionality in WolfCMS 0.8.3.1 allows remote attack
23RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Background Takeover < 4.1.4 - Directory Traversal
CVE-2018-9118—webappsphp09 abr 2018
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Direct
50RIESGO
abrir ↗
Exploit-DB
WolfCMS 0.8.3.1 - Cross-Site Request Forgery
CVE-2018-8814—webappsphp09 abr 2018
Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication
23RIESGO
abrir ↗
Exploit-DB
CyberArk Password Vault Web Access < 9.9.5 / < 9.10 / 10.1 - Remote Code Execution
CVE-2018-9843—webappsjson09 abr 2018
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute
28RIESGO
abrir ↗
Metasploit600
H2 Web Interface Create Alias RCE
CVE-2018-10054—09 abr 2018
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can
30RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WebKit - WebAssembly Parsing Does not Correctly Check Section Order
CVE-2018-4121—dosmultiple09 abr 2018
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud b
28RIESGO
abrir ↗
Exploit-DB
Cobub Razor 0.7.2 - Add New Superuser Account
CVE-2018-7745—webappsphp09 abr 2018
An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/inst
28RIESGO
abrir ↗
GitHub PoC★ 5
CVE-2017-8570生成脚本(CVE-2017-0199另一种利用方式)
CVE-2017-8570HIGHbajo ataque08 abr 2018
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
93RIESGO
abrir ↗
VulnCheck XDB
client-side
CVE-2017-8570HIGHbajo ataque08 abr 2018
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic
93RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Cobub Razor 0.7.2 - Cross-Site Request Forgery
CVE-2018-7746—webappsphp06 abr 2018
An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/chann
23RIESGO
abrir ↗
Exploit-DB
DotNetNuke DNNarticle Module 11 - Directory Traversal
CVE-2018-9126—webappswindows06 abr 2018
The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and conseque
35RIESGO
abrir ↗
Exploit-DB
Sophos Endpoint Protection Control Panel 10.7 - Weak Password Encryption
CVE-2018-9233—localwindows06 abr 2018
Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Vir
23RIESGO
abrir ↗
Exploit-DB
FiberHome VDSL2 Modem HG 150-UB - Authentication Bypass
CVE-2018-9248—webappshardware06 abr 2018
FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header.
28RIESGO
abrir ↗
GitHub PoC★ 2
Android Blueborne RCE CVE-2017-0781
CVE-2017-0781—06 abr 2018
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1
28RIESGO
abrir ↗
Exploit-DB
LineageOS 14.1 Blueborne - Remote Code Execution
CVE-2017-0781—remoteandroid06 abr 2018
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1
28RIESGO
abrir ↗
Exploit-DB
GNU Beep 1.3 - 'HoleyBeep' Local Privilege Escalation
CVE-2018-0492—locallinux06 abr 2018
Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.
23RIESGO
abrir ↗
GitHub PoC★ 3
Android Blueborne RCE CVE-2017-0781
CVE-2017-0781—06 abr 2018
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1
28RIESGO
abrir ↗
Exploit-DB
Adobe Flash < 28.0.0.161 - Use-After-Free
CVE-2018-4878HIGHbajo ataqueransomwareremotemultiple06 abr 2018
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to
93RIESGO
abrir ↗
Exploit-DB
Sophos Endpoint Protection 10.7 - Tamper-Protection Bypass
CVE-2018-4863—localwindows06 abr 2018
Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKE
23RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting
CVE-2018-8729—webappsphp05 abr 2018
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote a
23RIESGO
abrir ↗
Exploit-DB
Z-Blog 1.5.1.1740 - Cross-Site Scripting
CVE-2018-7736—webappsphp05 abr 2018
In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the so
23RIESGO
abrir ↗
Exploit-DB
YzmCMS 3.6 - Cross-Site Scripting
CVE-2018-7653—webappsphp05 abr 2018
In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.
38RIESGO
abrir ↗
Exploit-DB
WebRTC - Private IP Leakage (Metasploit)
CVE-2018-6849—webappsmultiple05 abr 2018
In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client informati
43RIESGO
abrir ↗
Exploit-DB
Z-Blog 1.5.1.1740 - Full Path Disclosure
CVE-2018-7737—webappsphp05 abr 2018
In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.ph
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows Defender - 'mpengine.dll' Memory Corruption
CVE-2018-0986—doswindows05 abr 2018
A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a speci
35RIESGO
abrir ↗
← anteriorpágina 1044 / 2900siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.