Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.150exploits catalogados

39.601CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9680Nuclei 4488Metasploit 3525✓ solo verificadosrecientes populares riesgo

4488 exploits

Nucleimedium

Titan FTP Server < 10.40 - User Properties Traversal

CVE-2014-1843—

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke

38RIESGO

abrir ↗

Nucleimedium

vsftpd <= 3.0.2 - Access Restriction Bypass

CVE-2015-1419—

Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown

18RIESGO

abrir ↗

Nucleicritical

ProFTPd - Remote Code Execution

CVE-2015-3306CRITICALbajo ataque

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

100RIESGO

abrir ↗

Nucleicritical

HP Data Protector - Arbitrary Command Execution

CVE-2016-2004—

HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary cod

60RIESGO

abrir ↗

Nucleicritical

Oracle WebLogic Server Java Object Deserialization - Remote Code Execution

CVE-2016-3510—

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12

40RIESGO

abrir ↗

Nucleicritical

Cisco IOS 12.2(55)SE11 - Remote Code Execution

CVE-2017-3881CRITICALbajo ataque

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co

100RIESGO

abrir ↗

Nucleicritical

Apache Log4j Server - Deserialization Command Execution

CVE-2017-5645—

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events

40RIESGO

abrir ↗

Nucleicritical

Oracle WebLogic Server Deserialization - Remote Code Execution

CVE-2018-2628CRITICALbajo ataque

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S

100RIESGO

abrir ↗

Nucleicritical

Oracle WebLogic Server - Remote Code Execution

CVE-2018-2893—

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S

60RIESGO

abrir ↗

Nucleihigh

ProFTPD < 1.3.6b - Remote Unauthenticated DoS

CVE-2019-18217—

ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handl

23RIESGO

abrir ↗

Nucleihigh

Pure-FTPd < 1.0.50 - DoS via Resource Exhaustion

CVE-2019-20176—

In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.

18RIESGO

abrir ↗

Nucleicritical

VMware ESXi SLP - Heap Overflow DoS

CVE-2019-5544CRITICALbajo ataqueransomware

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of

100RIESGO

abrir ↗

Nucleicritical

Microsoft SMBv3 - Remote Code Execution

CVE-2020-0796CRITICALbajo ataqueransomware

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RIESGO

abrir ↗

Nucleicritical

Apache Airflow <=1.10.10 - Command Injection

CVE-2020-11981—

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect t

30RIESGO

abrir ↗

Nucleicritical

Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability

CVE-2020-1938CRITICALbajo ataque

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RIESGO

abrir ↗

Nucleihigh

Pure-FTPd 1.0.48 - Denial of Service

CVE-2020-35359—

Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the con

18RIESGO

abrir ↗

Nucleihigh

Pure-FTPd ≤ 1.0.49 - DoS via Uninitialized Pointer

CVE-2020-9274—

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases

18RIESGO

abrir ↗

Nucleimedium

Pure-FTPd 1.0.24 - Security Vulnerability

CVE-2020-9365—

An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function i

18RIESGO

abrir ↗

Nucleihigh

vsftpd < 3.0.3 - DoS

CVE-2021-30047—

VSFTPD 3.0.3 allows attackers to cause a denial of service due to limited number of connections allowed.

18RIESGO

abrir ↗

Nucleicritical

NCR Command Center Agent 16.3 - Remote Command Execution

CVE-2021-3122—

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (wit

40RIESGO

abrir ↗

Nucleihigh

Pure-FTPd 1.0.23 < 1.0.50 - Arbitrary File Upload

CVE-2021-40524—

In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of

18RIESGO

abrir ↗

Nucleicritical

Apache Cassandra Load UDF RCE

CVE-2021-44521—

Remote code execution for scripted UDFs

30RIESGO

abrir ↗

Nucleicritical

Redis Sandbox Escape - Remote Code Execution

CVE-2022-0543CRITICALbajo ataque

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific

100RIESGO

abrir ↗

Nucleicritical

CouchDB Erlang Distribution - Remote Command Execution

CVE-2022-24706CRITICALbajo ataque

Remote Code Execution Vulnerability in Packaging

100RIESGO

abrir ↗

Nucleihigh

muhttpd <=1.1.5 - Local Inclusion

CVE-2022-31793—

do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL wi

23RIESGO

abrir ↗

Nucleimedium

KMCIS CaseAware - Cross-Site Scripting

CVE-2017-5631—

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr"

38RIESGO

abrir ↗

Nucleicritical

Apache Struts 2 - Remote Command Execution

CVE-2017-5638CRITICALbajo ataqueransomware

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

abrir ↗

Nucleicritical

Intel Active Management - Authentication Bypass

CVE-2017-5689CRITICALbajo ataque

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

100RIESGO

abrir ↗

Nucleimedium

OpenVPN Access Server 2.1.4 - CRLF Injection

CVE-2017-5868—

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit

18RIESGO

abrir ↗

Nucleimedium

Odoo <= 8.0-20160726 & 9.0 - Open Redirect

CVE-2017-5871—

Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive in

18RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.