Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.957exploits catalogados

32.195CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8182Nuclei 4217Metasploit 3462✓ solo verificadosrecientes populares riesgo

4217 exploits

Nucleicritical

WordPress Time Capsule < 1.21.16 - Authentication Bypass

CVE-2020-8771—

The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFI

30RIESGO

abrir ↗

Nucleicritical

WordPress InfiniteWP <1.9.4.5 - Authorization Bypass

CVE-2020-8772—

The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in in

40RIESGO

abrir ↗

Nucleihigh

Cacti v1.2.8 - Remote Code Execution

CVE-2020-8813—

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a

60RIESGO

abrir ↗

Nucleihigh

Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read

CVE-2020-8982—

An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones)

23RIESGO

abrir ↗

Nucleimedium

Jeedom <=4.0.38 - Cross-Site Scripting

CVE-2020-9036—

Jeedom through 4.0.38 allows XSS.

18RIESGO

abrir ↗

Nucleicritical

Couchbase Server - Broken Access Control

CVE-2020-9039—

Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Per

18RIESGO

abrir ↗

Nucleihigh

WordPress wpCentral <1.5.1 - Information Disclosure

CVE-2020-9043—

The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.

18RIESGO

abrir ↗

Nucleihigh

exacqVision Web Service - Remote Code Execution

CVE-2020-9047MEDIUM

exacqVision Software - Improper Verification of Cryptographic Signature

28RIESGO

abrir ↗

Nucleicritical

Zyxel NAS Firmware 5.21- Remote Code Execution

CVE-2020-9054CRITICALbajo ataque

ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi

100RIESGO

abrir ↗

Nucleimedium

Oracle iPlanet Web Server 7.0.x - Image Injection

CVE-2020-9314—

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x allows image injection in the Administration c

18RIESGO

abrir ↗

Nucleihigh

Oracle iPlanet Web Server 7.0.x - Authentication Bypass

CVE-2020-9315—

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/vers

40RIESGO

abrir ↗

Nucleimedium

Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting

CVE-2020-9344—

Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.

18RIESGO

abrir ↗

Nucleihigh

D-Link DIR-610 Devices - Information Disclosure

CVE-2020-9376—

D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE

23RIESGO

abrir ↗

Nucleihigh

rConfig <3.9.4 - Sensitive Information Disclosure

CVE-2020-9425—

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved

23RIESGO

abrir ↗

Nucleicritical

Apache Spark - Authentication Bypass

CVE-2020-9480—

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (s

23RIESGO

abrir ↗

Nucleihigh

SkyWalking SQLI

CVE-2020-9483—

**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is

30RIESGO

abrir ↗

Nucleihigh

Apache Tomcat Remote Command Execution

CVE-2020-9484—

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)

30RIESGO

abrir ↗

Nucleimedium

Apache OFBiz 17.12.03 - Cross-Site Scripting

CVE-2020-9496—

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

60RIESGO

abrir ↗

Nucleicritical

FasterXML jackson-databind - Deserialization Remote Code Execution

CVE-2020-9547—

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela

23RIESGO

abrir ↗

Nucleicritical

FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution

CVE-2020-9548—

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela

23RIESGO

abrir ↗

Nucleicritical

Craft CMS < 3.3.0 - Server-Side Template Injection

CVE-2020-9757—

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed

40RIESGO

abrir ↗

Nucleicritical

Cisco Small Business RV Series - OS Command Injection

CVE-2021-1472MEDIUM

Cisco Small Business RV Series Routers Vulnerabilities

50RIESGO

abrir ↗

Nucleicritical

Cisco HyperFlex HX Data Platform - Remote Command Execution

CVE-2021-1497CRITICALbajo ataque

Cisco HyperFlex HX Command Injection Vulnerabilities

100RIESGO

abrir ↗

Nucleicritical

Advantech R-SeeNet 2.4.12 - OS Command Injection

CVE-2021-21805CRITICAL

An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.

55RIESGO

abrir ↗

Nucleimedium

D-Link DIR-3040 1.13B03 - Information Disclosure

CVE-2021-21816MEDIUM

An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-3040 1.13B03. A specially craft

40RIESGO

abrir ↗

Nucleicritical

Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection

CVE-2021-21881CRITICAL

An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix Prem

55RIESGO

abrir ↗

Nucleicritical

VMware vSphere Client (HTML5) - Remote Code Execution

CVE-2021-21972CRITICALbajo ataqueransomware

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor

100RIESGO

abrir ↗

Nucleimedium

VMware vSphere - Server-Side Request Forgery

CVE-2021-21973MEDIUMbajo ataque

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of UR

100RIESGO

abrir ↗

Nucleihigh

vRealize Operations Manager API - Server-Side Request Forgery

CVE-2021-21975HIGHbajo ataqueransomware

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor

100RIESGO

abrir ↗

Nucleicritical

VMware View Planner <4.6 SP1- Remote Code Execution

CVE-2021-21978—

VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input val

60RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.