Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
86.991 exploits
Exploit-DB✓ VexDay Proof
WordPress Plugin Smart Google Code Inserter < 3.5 - Authentication Bypass / SQL Injection
CVE-2018-3811—webappsphp03 ene 2018
SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthentica
35RIESGO
abrir ↗
GitHub PoC★ 3
forked from https://github.com/s3xy/CVE-2017-10271. Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.Modified by hanc00l
CVE-2017-10271HIGHbajo ataqueransomware03 ene 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2017-10271HIGHbajo ataqueransomware03 ene 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗
Exploit-DB
Multiple CPUs - 'Spectre' Information Disclosure
CVE-2017-5715MEDIUMlocalmultiple03 ene 2018
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl
55RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin Smart Google Code Inserter < 3.5 - Authentication Bypass / SQL Injection
CVE-2018-3810—webappsphp03 ene 2018
Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unau
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Oracle WebLogic < 10.3.6 - 'wls-wsat' Component Deserialisation Remote Command Execution
CVE-2017-10271HIGHbajo ataqueransomwareremotemultiple03 ene 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2017-3881CRITICALbajo ataque02 ene 2018
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co
100RIESGO
abrir ↗
GitHub PoC★ 2
credit to artkond
CVE-2017-3881CRITICALbajo ataque02 ene 2018
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co
100RIESGO
abrir ↗
GitHub PoC
Exploit for CVE-2003-0264 based on pwntools and metasploit's windows/reverse_tcp
CVE-2003-0264—01 ene 2018
Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO arg
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
HP Mercury LoadRunner Agent magentproc.exe - Remote Command Execution (Metasploit)
CVE-2010-1549—remotewindows01 ene 2018
Unspecified vulnerability in the Agent in HP LoadRunner before 9.50 and HP Performance Center before 9.50 allows remote
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Cambium ePMP1000 - 'get_chart' Shell via Command Injection (Metasploit)
CVE-2017-5255—remotecgi01 ene 2018
In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web
60RIESGO
abrir ↗
Exploit-DB
PHP Melody 2.7.1 - 'playlist' SQL Injection
CVE-2018-5211—webappsphp31 dic 2017
PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.
23RIESGO
abrir ↗
GitHub PoC★ 15
xyzAsian/Janus-CVE-2017-13156
CVE-2017-13156—29 dic 2017
An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0,
43RIESGO
abrir ↗
VulnCheck XDB
local
CVE-2017-13156—29 dic 2017
An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0,
43RIESGO
abrir ↗
Exploit-DB
NetTransport 2.96L - Remote Buffer Overflow (DEP Bypass)
CVE-2017-17968—remotewindows29 dic 2017
A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remot
50RIESGO
abrir ↗
Exploit-DB
ALLMediaServer 0.95 - Remote Buffer Overflow (Metasploit)
CVE-2017-17932—remotewindows28 dic 2017
A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow
50RIESGO
abrir ↗
GitHub PoC★ 140
WebLogic Exploit
CVE-2017-10271HIGHbajo ataqueransomware28 dic 2017
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2017-10271HIGHbajo ataqueransomware28 dic 2017
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗
GitHub PoC★ 29
CVE-2017-10271 POC
CVE-2017-10271HIGHbajo ataqueransomware28 dic 2017
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2017-10271HIGHbajo ataqueransomware28 dic 2017
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
SysGauge Server 3.6.18 - Denial of Service
CVE-2017-15667—doswindows27 dic 2017
In Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service. The attack vector is a crafte
23RIESGO
abrir ↗
Exploit-DB
ALLMediaServer 0.95 - Buffer Overflow (PoC)
CVE-2017-17932—doswindows27 dic 2017
A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow
50RIESGO
abrir ↗
GitHub PoC★ 1
CVE-2017-17562 GOAHEAD RCE (Author: Daniel Hodson)
CVE-2017-17562HIGHbajo ataque27 dic 2017
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2017-17562HIGHbajo ataque27 dic 2017
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RIESGO
abrir ↗
Exploit-DB
Joomla! Component JEXTN FAQ Pro 4.0.0 - 'id' SQL Injection
CVE-2017-17875—webappsphp26 dic 2017
The JEXTN FAQ Pro extension 4.0.0 for Joomla! has SQL Injection via the id parameter in a view=category action.
23RIESGO
abrir ↗
GitHub PoC★ 4
CVE-2017-12615 Tomcat RCE (TESTED)
CVE-2017-12615HIGHbajo ataqueransomware26 dic 2017
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati
100RIESGO
abrir ↗
Exploit-DB
GetGo Download Manager 5.3.0.2712 - Buffer Overflow
CVE-2017-17849—doswindows26 dic 2017
A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to exec
28RIESGO
abrir ↗
Exploit-DB
Trustwave SWG 11.8.0.27 - SSH Unauthorized Access
CVE-2017-18001—remotelinux26 dic 2017
Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the de
28RIESGO
abrir ↗
Exploit-DB
Biometric Shift Employee Management System 3.0 - Local File Disclosure
CVE-2017-17876—webappsphp26 dic 2017
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a u
23RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2017-12615HIGHbajo ataqueransomware26 dic 2017
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati
100RIESGO
abrir ↗
← anteriorpágina 1064 / 2900siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.