Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

84.150exploits catalogados

39.601CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9680Nuclei 4488Metasploit 3525✓ solo verificadosrecientes populares riesgo

4488 exploits

Nucleimedium

Optergy Proton/Enterprise Building Management System - Open Redirect

CVE-2019-7275—

Optergy Proton/Enterprise devices allow Open Redirect.

18RIESGO

abrir ↗

Nucleicritical

Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console

CVE-2019-7276—

Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.

60RIESGO

abrir ↗

Nucleihigh

Genie Access WIP3BVAF IP Camera - Local File Inclusion

CVE-2019-7315—

Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal

23RIESGO

abrir ↗

Nucleihigh

SonicWall SRA 4600 VPN - SQL Injection

CVE-2019-7481HIGHbajo ataqueransomware

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vu

88RIESGO

abrir ↗

Nucleimedium

KindEditor 4.1.11 - Cross-Site Scripting

CVE-2019-7543—

In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.

18RIESGO

abrir ↗

Nucleicritical

Kibana Timelion - Arbitrary Code Execution

CVE-2019-7609CRITICALbajo ataque

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker

100RIESGO

abrir ↗

Nucleihigh

Adobe Experience Manager - XML External Entity Injection

CVE-2019-8086—

Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful e

23RIESGO

abrir ↗

Nucleimedium

qdPM 9.1 - Cross-site Scripting

CVE-2019-8390—

qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.

38RIESGO

abrir ↗

Nucleihigh

Jira - Local File Inclusion

CVE-2019-8442—

The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4,

30RIESGO

abrir ↗

Nucleimedium

Jira Improper Authorization

CVE-2019-8446—

The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via

23RIESGO

abrir ↗

Nucleimedium

Jira <8.4.0 - Information Disclosure

CVE-2019-8449—

The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate username

60RIESGO

abrir ↗

Nucleimedium

Jira <8.4.0 - Server-Side Request Forgery

CVE-2019-8451—

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the con

60RIESGO

abrir ↗

Nucleihigh

Totaljs <3.2.3 - Local File Inclusion

CVE-2019-8903—

index.js in Total.js Platform before 3.2.3 allows path traversal.

40RIESGO

abrir ↗

Nucleimedium

HotelDruid 2.3.0 - Cross-Site Scripting

CVE-2019-8937—

HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel

43RIESGO

abrir ↗

Nucleimedium

WordPress Core 5.0.0 - Crop-image Shell Upload

CVE-2019-8943—

WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can

60RIESGO

abrir ↗

Nucleicritical

Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery

CVE-2019-8982—

com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&

43RIESGO

abrir ↗

Nucleihigh

ZZZCMS 1.6.1 - Remote Code Execution

CVE-2019-9041—

An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filter

50RIESGO

abrir ↗

Nucleihigh

ThinkPHP < 3.2.4 - Remote Code Execution

CVE-2019-9082HIGHbajo ataque

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/

100RIESGO

abrir ↗

Nucleicritical

Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint

CVE-2020-11514—

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPres

18RIESGO

abrir ↗

Nucleimedium

Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

CVE-2020-11515—

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that red

18RIESGO

abrir ↗

Nucleimedium

Grav < 1.7 - Open Redirect

CVE-2020-11529—

Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.

23RIESGO

abrir ↗

Nucleicritical

WordPress Chop Slider 3 - Blind SQL Injection

CVE-2020-11530—

A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in

60RIESGO

abrir ↗

Nucleicritical

SuperWebmailer 7.21.0.01526 - Remote Code Execution

CVE-2020-11546—

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailing

50RIESGO

abrir ↗

Nucleimedium

PRTG Network Monitor <20.1.57.1745 - Information Disclosure

CVE-2020-11547—

PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes runn

30RIESGO

abrir ↗

Nucleicritical

Kong Admin <=2.03 - Admin API Access

CVE-2020-11710—

An issue was discovered in docker-kong (for Kong) through 2.0.3. The admin API port may be accessible on interfaces othe

30RIESGO

abrir ↗

Nucleihigh

Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion

CVE-2020-11732—

The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_ga

18RIESGO

abrir ↗

Nucleihigh

WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion

CVE-2020-11738HIGHbajo ataque

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traver

100RIESGO

abrir ↗

Nucleimedium

Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal

CVE-2020-11798—

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before

50RIESGO

abrir ↗

Nucleihigh

Micro Focus Operations Bridge Manager <=2020.05 - Remote Code Execution

CVE-2020-11853HIGH

Arbitrary code execution vulnerability on multiple Micro Focus products

58RIESGO

abrir ↗

Nucleicritical

Micro Focus UCMDB - Remote Code Execution

CVE-2020-11854CRITICAL

Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products.

85RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.