Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.035exploits catalogados

39.531CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientes populares riesgo

4478 exploits

Nucleimedium

Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting

CVE-2018-20824—

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScri

30RIESGO

abrir ↗

Nucleicritical

WordPress Payeezy Pay <=2.97 - Local File Inclusion

CVE-2018-20985—

The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay

18RIESGO

abrir ↗

Nucleihigh

SAP Internet Graphics Server (IGS) - XML External Entity Injection

CVE-2018-2392—

Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML Exter

50RIESGO

abrir ↗

Nucleicritical

osCommerce 2.3.4.1 - Remote Code Execution

CVE-2018-25114CRITICAL

osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution

63RIESGO

abrir ↗

Nucleihigh

Oracle Fusion Middleware WebCenter Sites - Cross-Site Scripting

CVE-2018-2791—

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported

50RIESGO

abrir ↗

Nucleicritical

Oracle WebLogic Server - Remote Code Execution

CVE-2018-2894—

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Su

50RIESGO

abrir ↗

Nucleimedium

Oracle E-Business Suite - Blind SSRF

CVE-2018-3167—

Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subco

23RIESGO

abrir ↗

Nucleimedium

Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting

CVE-2018-3238—

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The suppo

18RIESGO

abrir ↗

Nucleimedium

node-srv - Local File Inclusion

CVE-2018-3714—

node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malici

18RIESGO

abrir ↗

Nucleihigh

Ruby On Rails - Local File Inclusion

CVE-2018-3760—

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12

43RIESGO

abrir ↗

Nucleicritical

Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass

CVE-2018-3810—

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unau

60RIESGO

abrir ↗

Nucleimedium

Atlassian Jira Confluence - Cross-Site Scripting

CVE-2018-5230—

The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0

30RIESGO

abrir ↗

Nucleimedium

Grav CMS <1.3.0 - Cross-Site Scripting

CVE-2018-5233—

Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote

18RIESGO

abrir ↗

Nucleimedium

WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting

CVE-2018-5316—

The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.p

18RIESGO

abrir ↗

Nucleimedium

SugarCRM 3.5.1 - Cross-Site Scripting

CVE-2018-5715—

phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable).

38RIESGO

abrir ↗

Nucleihigh

Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion

CVE-2018-6008—

Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter

50RIESGO

abrir ↗

Nucleihigh

Zeit Next.js < 4.2.3 - Local File Inclusion

CVE-2018-6184—

ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.

18RIESGO

abrir ↗

Nucleimedium

vBulletin - Open Redirect

CVE-2018-6200—

vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.

18RIESGO

abrir ↗

Nucleicritical

D-Link - Unauthenticated Remote Code Execution

CVE-2018-6530CRITICALbajo ataqueransomware

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_

95RIESGO

abrir ↗

Nucleihigh

Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution

CVE-2019-0232—

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RIESGO

abrir ↗

Nucleihigh

Jenkins Script Security Plugin <=1.49 - Sandbox Bypass

CVE-2019-1003000—

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/

60RIESGO

abrir ↗

Nucleicritical

Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization

CVE-2019-1003030CRITICALbajo ataque

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/

100RIESGO

abrir ↗

Nucleicritical

Kentico CMS Insecure Deserialization Remote Code Execution

CVE-2019-10068CRITICALbajo ataque

An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions

100RIESGO

abrir ↗

Nucleimedium

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting

CVE-2019-10092—

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page

60RIESGO

abrir ↗

Nucleimedium

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect

CVE-2019-10098—

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential m

60RIESGO

abrir ↗

Nucleimedium

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting

CVE-2019-1010287—

Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to ex

18RIESGO

abrir ↗

Nucleimedium

Babel - Open Redirect

CVE-2019-1010290—

Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is sup

18RIESGO

abrir ↗

Nucleicritical

Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection

CVE-2019-10232—

Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.

23RIESGO

abrir ↗

Nucleimedium

Jenkins <=2.196 - Cookie Exposure

CVE-2019-10405—

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/

30RIESGO

abrir ↗

Nucleimedium

Jenkins build-metrics 1.3 - Cross-Site Scripting

CVE-2019-10475—

A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML

50RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.