Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.957exploits catalogados
32.195CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.003GitHub PoC 13.307VulnCheck XDB 8182Nuclei 4217Metasploit 3462✓ solo verificadosrecientespopularesriesgo
22.786 exploits
Exploit-DB
Microsoft Windows Kernel - 'win32k.sys' Multiple 'NtGdiGetDIBitsInternal' System Call
CVE-2017-0058—13 abr 2017
A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides
23RIESGO
abrir ↗
Exploit-DB
Microsoft Windows Kernel - 'win32kfull!SfnINLPUAHDRAWMENUITEM' Stack Memory Disclosure
CVE-2017-0167—13 abr 2017
An information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 10, and W
23RIESGO
abrir ↗
Exploit-DB
Cisco Catalyst 2960 IOS 12.2(55)SE11 - 'ROCEM' Remote Code Execution
CVE-2017-3881CRITICALbajo ataque12 abr 2017
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co
100RIESGO
abrir ↗
Exploit-DB
Cisco Catalyst 2960 IOS 12.2(55)SE1 - 'ROCEM' Remote Code Execution
CVE-2017-3881CRITICALbajo ataque12 abr 2017
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co
100RIESGO
abrir ↗
Exploit-DB
Apple WebKit / Safari 10.0.3 (12602.4.8) - Synchronous Page Load Universal Cross-Site Scripting
CVE-2017-2480—11 abr 2017
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud b
23RIESGO
abrir ↗
Exploit-DB
Brother MFC-J6520DW - Authentication Bypass / Password Change
CVE-2017-7588—11 abr 2017
On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a
35RIESGO
abrir ↗
Exploit-DB
Apple WebKit / Safari 10.0.3 (12602.4.8) - Universal Cross-Site Scripting via a Focus Event and a Link Element
CVE-2017-2479—11 abr 2017
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud b
23RIESGO
abrir ↗
Exploit-DB
Apple WebKit - 'Document::adoptNode' Use-After-Free
CVE-2017-2468—11 abr 2017
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RIESGO
abrir ↗
Exploit-DB
Apple WebKit - 'JSC::B3::Procedure::resetReachability' Use-After-Free
CVE-2017-2470—11 abr 2017
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RIESGO
abrir ↗
Exploit-DB
Apple WebKit - 'JSC::SymbolTableEntry::isWatchable' Heap Buffer Overflow
CVE-2017-2469—11 abr 2017
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RIESGO
abrir ↗
Exploit-DB
Xen - Broken Check in 'memory_exchange()' Permits PV Guest Breakout
CVE-2017-7228—11 abr 2017
An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The e
23RIESGO
abrir ↗
Exploit-DB
Quest Privilege Manager 6.0.0 - Arbitrary File Write
CVE-2017-6554—10 abr 2017
pmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows remote attackers to wr
28RIESGO
abrir ↗
Exploit-DB
Moxa MXview 2.8 - Denial of Service
CVE-2017-7456—10 abr 2017
Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView
28RIESGO
abrir ↗
Exploit-DB
Moxa MX AOPC-Server 1.5 - XML External Entity Injection
CVE-2017-7457—10 abr 2017
XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure.
23RIESGO
abrir ↗
Exploit-DB
Moxa MXview 2.8 - Private Key Disclosure
CVE-2017-7455—10 abr 2017
Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.
28RIESGO
abrir ↗
Exploit-DB
QNAP TVS-663 QTS < 4.2.4 build 20170313 - Command Injection
CVE-2017-6359—07 abr 2017
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
28RIESGO
abrir ↗
Exploit-DB
QNAP TVS-663 QTS < 4.2.4 build 20170313 - Command Injection
CVE-2017-6361—07 abr 2017
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.
35RIESGO
abrir ↗
Exploit-DB
Intellinet NFC-30IR Camera - Multiple Vulnerabilities
CVE-2017-7461—07 abr 2017
Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM
28RIESGO
abrir ↗
Exploit-DB
Adobe (Multiple Products) - XML Injection File Content Disclosure
CVE-2009-3960MEDIUMbajo ataqueransomware07 abr 2017
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Service
100RIESGO
abrir ↗
Exploit-DB
D-Link DWR-116 / DWR-116A1 - Arbitrary File Download
CVE-2017-6190—07 abr 2017
Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows
28RIESGO
abrir ↗
Exploit-DB
QNAP TVS-663 QTS < 4.2.4 build 20170313 - Command Injection
CVE-2017-6360—07 abr 2017
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
35RIESGO
abrir ↗
Exploit-DB
Intellinet NFC-30IR Camera - Multiple Vulnerabilities
CVE-2017-7462—07 abr 2017
Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI scr
28RIESGO
abrir ↗
Exploit-DB
Moodle 2.x/3.x - SQL Injection
CVE-2017-2641—06 abr 2017
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
28RIESGO
abrir ↗
Exploit-DB
Cesanta Mongoose OS - Use-After-Free
CVE-2017-7185—06 abr 2017
Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embed
28RIESGO
abrir ↗
Exploit-DB
SpiceWorks 7.5 TFTP - Remote File Overwrite / Upload
CVE-2017-7237—05 abr 2017
The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spicewor
23RIESGO
abrir ↗
Exploit-DB
Faveo Helpdesk Community 1.9.3 - Cross-Site Request Forgery
CVE-2017-7571—05 abr 2017
public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges.
23RIESGO
abrir ↗
Exploit-DB
HelpDEZK 1.1.1 - Cross-Site Request Forgery / Code Execution
CVE-2017-7447—05 abr 2017
HelpDEZk 1.1.1 has CSRF in admin/home#/logos/ with an impact of remote execution of arbitrary PHP code.
23RIESGO
abrir ↗
Exploit-DB
D-Link DIR-615 - Cross-Site Request Forgery
CVE-2017-7398—05 abr 2017
D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacke
23RIESGO
abrir ↗
Exploit-DB
HelpDEZK 1.1.1 - Cross-Site Request Forgery / Code Execution
CVE-2017-7446—05 abr 2017
HelpDEZk 1.1.1 has CSRF in admin/home#/person/ with an impact of obtaining admin privileges.
23RIESGO
abrir ↗
Exploit-DB
Apple WebKit 10.0.2 (12602.3.12.0.1) - 'disconnectSubframes' Universal Cross-Site Scripting
CVE-2017-2445—04 abr 2017
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RIESGO
abrir ↗
← anteriorpágina 140 / 760siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.