Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.127exploits catalogados
39.600CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.618Exploit-DB 24.485GitHub PoC 16.333VulnCheck XDB 9678Nuclei 4488Metasploit 3525✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB
Ubiquiti UniFi Video 3.7.3 - Local Privilege Escalation
Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local u
23RIESGO
abrir ↗Exploit-DB
Trustwave SWG 11.8.0.27 - SSH Unauthorized Access
Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the de
28RIESGO
abrir ↗Exploit-DB
Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command Execution
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RIESGO
abrir ↗Exploit-DB
Biometric Shift Employee Management System 3.0 - Local File Disclosure
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a u
23RIESGO
abrir ↗Exploit-DB
GetGo Download Manager 5.3.0.2712 - Buffer Overflow
A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to exec
28RIESGO
abrir ↗Exploit-DB
Huawei Router HG532 - Arbitrary Command Execution
Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could se
45RIESGO
abrir ↗Exploit-DB
Iopsys Router - 'dhcp' Remote Code Execution
Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying th
28RIESGO
abrir ↗Exploit-DB
Conarc iChannel - Improper Access Restrictions
Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of
28RIESGO
abrir ↗Exploit-DB
Ability Mail Server 3.3.2 - Cross-Site Scripting
Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code execute
23RIESGO
abrir ↗Exploit-DB
Samsung Internet Browser - SOP Bypass (Metasploit)
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
60RIESGO
abrir ↗Exploit-DB
BEIMS ContractorWeb 5.18.0.0 - SQL Injection
CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, ass
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - jscript.dll 'Array.sort' Heap Overflow
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Se
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'jscript!RegExpFncObj::LastParen' Out-of-Bounds Read
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Se
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'jscript!NameTbl::GetValDef' Use-After-Free
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Se
35RIESGO
abrir ↗Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and b
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 11 - 'jscript!JSONStringifyObject' Use-After-Free
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Window
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Jenkins - XStream Groovy classpath Deserialization (Metasploit)
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
60RIESGO
abrir ↗Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to pe
28RIESGO
abrir ↗Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to pe
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'jscript!RegExpComp::Compile' Heap Overflow Through IE or Local Network via WPAD
Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Win
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Tuleap 9.6 - Second-Order PHP Object Injection (Metasploit)
An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentEl
50RIESGO
abrir ↗Exploit-DB
BrightSign Digital Signage - Multiple Vulnerablities
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html
28RIESGO
abrir ↗Exploit-DB
Ichano AtHome IP Cameras - Multiple Vulnerabilities
An issue was discovered on Ichano AtHome IP Camera devices. The device runs the "noodles" binary - a service on port 130
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Intel Content Protection HECI Service - Type Confusion Privilege Escalation
Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privilege
23RIESGO
abrir ↗Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 an
23RIESGO
abrir ↗Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below coul
28RIESGO
abrir ↗Exploit-DB
BrightSign Digital Signage - Multiple Vulnerablities
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diag
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'jscript!JsArraySlice' Uninitialized Variable
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Window
35RIESGO
abrir ↗Exploit-DB
BrightSign Digital Signage - Multiple Vulnerablities
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
GoAhead Web Server 2.5 < 3.6.5 - HTTPd 'LD_PRELOAD' Remote Code Execution
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.