Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.144exploits catalogados

39.601CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.629Exploit-DB 24.485GitHub PoC 16.337VulnCheck XDB 9680Nuclei 4488Metasploit 3525✓ solo verificadosrecientes populares riesgo

4488 exploits

Nucleimedium

Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect

CVE-2018-14931—

An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. An open redirect exis

18RIESGO

abrir ↗

Nucleicritical

NUUO NVRmini - Remote Command Execution

CVE-2018-14933CRITICALbajo ataque

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir par

100RIESGO

abrir ↗

Nucleihigh

LG-Ericsson iPECS NMS 30M - Local File Inclusion

CVE-2018-15138—

Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs.

23RIESGO

abrir ↗

Nucleihigh

D-Link Central WifiManager - Server-Side Request Forgery

CVE-2018-15517—

The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an

30RIESGO

abrir ↗

Nucleihigh

Responsive FileManager <9.13.4 - Local File Inclusion

CVE-2018-15535—

/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname

50RIESGO

abrir ↗

Nucleihigh

Argus Surveillance DVR 4.0.0.0 - Local File Inclusion

CVE-2018-15745—

Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F

60RIESGO

abrir ↗

Nucleihigh

DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization

CVE-2018-15811HIGHbajo ataque

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

100RIESGO

abrir ↗

Nucleimedium

Jorani Leave Management System 0.6.5 - Cross-Site Scripting

CVE-2018-15917—

Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HT

38RIESGO

abrir ↗

Nucleicritical

Adobe ColdFusion - Unrestricted File Upload Remote Code Execution

CVE-2018-15961CRITICALbajo ataque

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr

100RIESGO

abrir ↗

Nucleimedium

WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion

CVE-2018-16059—

Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename par

43RIESGO

abrir ↗

Nucleimedium

Cybrotech CyBroHttpServer 1.0.3 - Local File Inclusion

CVE-2018-16133—

Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.

50RIESGO

abrir ↗

Nucleimedium

BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting

CVE-2018-16139—

Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web sc

18RIESGO

abrir ↗

Nucleicritical

WordPress Gift Voucher <4.1.8 - Blind SQL Injection

CVE-2018-16159—

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/ad

30RIESGO

abrir ↗

Nucleicritical

LogonTracer <=1.2.0 - Remote Command Injection

CVE-2018-16167—

LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

60RIESGO

abrir ↗

Nucleicritical

WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion

CVE-2018-16283—

The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.

50RIESGO

abrir ↗

Nucleihigh

LG SuperSign EZ CMS 2.5 - Local File Inclusion

CVE-2018-16288—

LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.

50RIESGO

abrir ↗

Nucleihigh

WordPress Localize My Post 1.0 - Local File Inclusion

CVE-2018-16299—

The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.

50RIESGO

abrir ↗

Nucleimedium

WordPress File Manager < 3.0 - Cross-Site Scripting

CVE-2018-16363—

The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_f

18RIESGO

abrir ↗

Nucleimedium

CirCarLife <4.3 - Improper Authentication

CVE-2018-16668—

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the l

18RIESGO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7192—

Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remot

18RIESGO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7193—

Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attac

18RIESGO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7196—

Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers

18RIESGO

abrir ↗

Nucleicritical

Anchor CMS 0.12.3 - Error Log Exposure

CVE-2018-7251—

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contain

60RIESGO

abrir ↗

Nucleicritical

TITool PrintMonitor - Blind SQL Injection

CVE-2018-7282—

The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based b

23RIESGO

abrir ↗

Nucleicritical

Joomla! Component PrayerCenter 3.0.2 - SQL Injection

CVE-2018-7314—

SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerabil

50RIESGO

abrir ↗

Nucleihigh

WordPress Site Editor <=1.1.1 - Local File Inclusion

CVE-2018-7422—

A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to re

50RIESGO

abrir ↗

Nucleihigh

AxxonSoft Axxon Next - Local File Inclusion

CVE-2018-7467—

AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI.

23RIESGO

abrir ↗

Nucleihigh

uWSGI PHP Plugin Local File Inclusion

CVE-2018-7490—

uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversa

50RIESGO

abrir ↗

Nucleicritical

Drupal - Remote Code Execution

CVE-2018-7600CRITICALbajo ataqueransomware

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RIESGO

abrir ↗

Nucleicritical

Drupal - Remote Code Execution

CVE-2018-7602HIGHbajo ataqueransomware

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.