Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.886exploits catalogados
32.153CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8176Nuclei 4202Metasploit 3462✓ solo verificadosrecientespopularesriesgo
22.786 exploits
Exploit-DB
OpenText Document Sciences xPression 4.5SP1 Patch 13 - 'jobRunId' SQL Injection
CVE-2017-14757—02 oct 2017
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might b
23RIESGO
abrir ↗
Exploit-DB
OpenText Document Sciences xPression 4.5SP1 Patch 13 - 'documentId' SQL Injection
CVE-2017-14758—02 oct 2017
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might b
23RIESGO
abrir ↗
Exploit-DB
phpCollab 2.5.1 - SQL Injection
CVE-2017-6089—02 oct 2017
SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗
Exploit-DB
Dnsmasq < 2.78 - Integer Underflow
CVE-2017-14496—02 oct 2017
Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-su
35RIESGO
abrir ↗
Exploit-DB
Dnsmasq < 2.78 - Information Leak
CVE-2017-14494—02 oct 2017
dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vect
35RIESGO
abrir ↗
Exploit-DB
Dnsmasq < 2.78 - Lack of free() Denial of Service
CVE-2017-14495—02 oct 2017
Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote
45RIESGO
abrir ↗
Exploit-DB
phpCollab 2.5.1 - Arbitrary File Upload
CVE-2017-6090—02 oct 2017
Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authentica
60RIESGO
abrir ↗
Exploit-DB
Dnsmasq < 2.78 - Heap Overflow
CVE-2017-14492—02 oct 2017
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
45RIESGO
abrir ↗
Exploit-DB
UCOPIA Wireless Appliance < 5.1.8 - Restricted Shell Escape
CVE-2017-11321—02 oct 2017
The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admi
23RIESGO
abrir ↗
Exploit-DB
Dnsmasq < 2.78 - Stack Overflow
CVE-2017-14493—02 oct 2017
Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu
45RIESGO
abrir ↗
Exploit-DB
Dnsmasq < 2.78 - 2-byte Heap Overflow
CVE-2017-14491—02 oct 2017
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
45RIESGO
abrir ↗
Exploit-DB
Qmail SMTP - Bash Environment Variable Injection (Metasploit)
CVE-2014-6271CRITICALbajo ataque02 oct 2017
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗
Exploit-DB
Linux Kernel < 4.14.rc3 - Local Denial of Service
CVE-2017-14489—02 oct 2017
The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to
23RIESGO
abrir ↗
Exploit-DB
UCOPIA Wireless Appliance < 5.1.8 - Local Privilege Escalation
CVE-2017-11322—02 oct 2017
The chroothole_client executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileg
23RIESGO
abrir ↗
Exploit-DB
Microsoft Excel - OLE Arbitrary Code Execution
CVE-2017-0199HIGHbajo ataqueransomware30 sep 2017
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RIESGO
abrir ↗
Exploit-DB
ConverTo Video Downloader & Converter 1.4.1 - Arbitrary File Download
CVE-2017-15956—29 sep 2017
ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php.
23RIESGO
abrir ↗
Exploit-DB
Trend Micro OfficeScan 11.0/XG (12.0) - Memory Corruption
CVE-2017-14089—29 sep 2017
An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated u
23RIESGO
abrir ↗
Exploit-DB
WordPress Plugin WPHRM - SQL Injection
CVE-2017-14848—29 sep 2017
WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.
23RIESGO
abrir ↗
Exploit-DB
FileRun < 2017.09.18 - SQL Injection
CVE-2017-14738—29 sep 2017
FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize in
23RIESGO
abrir ↗
Exploit-DB
Trend Micro OfficeScan 11.0/XG (12.0) - Private Key Disclosure
CVE-2017-14083—28 sep 2017
A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to d
23RIESGO
abrir ↗
Exploit-DB
Trend Micro OfficeScan 11.0/XG (12.0) - Man In The Middle Remote Code Execution
CVE-2017-14084—28 sep 2017
A potential Man-in-the-Middle (MitM) attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow attackers to e
28RIESGO
abrir ↗
Exploit-DB
Trend Micro OfficeScan 11.0/XG (12.0) - Information Disclosure
CVE-2017-14085—28 sep 2017
Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can acc
23RIESGO
abrir ↗
Exploit-DB
Trend Micro OfficeScan 11.0/XG (12.0) - 'Host' Header Injection
CVE-2017-14087—28 sep 2017
A Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) may allow an attacker to spoof a particular Ho
23RIESGO
abrir ↗
Exploit-DB
Trend Micro OfficeScan 11.0/XG (12.0) - Code Execution / Memory Corruption
CVE-2017-14086—28 sep 2017
Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated u
23RIESGO
abrir ↗
Exploit-DB
Cisco Prime Collaboration Provisioning < 12.1 - Authentication Bypass / Remote Code Execution
CVE-2017-6622—27 sep 2017
A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote a
35RIESGO
abrir ↗
Exploit-DB
Oracle WebLogic Server 10.3.6.0 - Java Deserialization Remote Code Execution
CVE-2015-4852CRITICALbajo ataque27 sep 2017
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
100RIESGO
abrir ↗
Exploit-DB
LAquis SCADA 4.1.0.2385 - Directory Traversal (Metasploit)
CVE-2017-6020—27 sep 2017
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237
23RIESGO
abrir ↗
Exploit-DB
SmarterStats 11.3.6347 - Cross-Site Scripting
CVE-2017-14620—27 sep 2017
SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQu
23RIESGO
abrir ↗
Exploit-DB
SMSmaster - SQL Injection
CVE-2017-14842—26 sep 2017
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
23RIESGO
abrir ↗
Exploit-DB
WordPress Plugin WPGYM - SQL Injection
CVE-2017-14844—26 sep 2017
Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
23RIESGO
abrir ↗
← anteriorpágina 122 / 760siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.