Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.039exploits catalogados
39.796CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.790Exploit-DB 24.487GitHub PoC 16.910VulnCheck XDB 9820Nuclei 4504Metasploit 3528✓ solo verificadosrecientespopularesriesgo
24.487 exploits
Exploit-DB
iBall Baton 150M Wireless Router - Authentication Bypass
CVE-2017-6558—webappsphp07 mar 2017
iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vuln
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Azure Data Expert Ultimate 2.2.16 - Remote Buffer Overflow
CVE-2017-6506—remotewindows07 mar 2017
In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leadi
28RIESGO
abrir ↗
Exploit-DB
USBPcap 1.1.0.0 (WireShark 2.2.5) - Local Privilege Escalation
CVE-2017-6178—localwindows07 mar 2017
The IofCallDriver function in USBPcap 1.1.0.0 allows local users to gain privileges via a crafted 0x00090028 IOCTL call,
23RIESGO
abrir ↗
Exploit-DB
Evostream Media Server 1.7.1 (x64) - Denial of Service
CVE-2017-6427—doswindows_x86-6407 mar 2017
A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A crafted HTTP request with a malicious header will ca
23RIESGO
abrir ↗
Exploit-DB
Deluge Web UI 1.3.13 - Cross-Site Request Forgery
CVE-2017-7178—webappsjson06 mar 2017
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted p
23RIESGO
abrir ↗
Exploit-DB
MikroTik Router - ARP Table OverFlow Denial Of Service
CVE-2017-6444—doshardware05 mar 2017
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
FTPShell Client 6.53 - Remote Buffer Overflow
CVE-2017-6465—remotewindows04 mar 2017
Remote Code Execution was discovered in FTPShell Client 6.53. By default, the client sends a PWD command to the FTP serv
50RIESGO
abrir ↗
Exploit-DB
Multiple WordPress Plugins - Arbitrary File Upload
CVE-2017-1002000—webappsphp03 mar 2017
Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-
28RIESGO
abrir ↗
Exploit-DB
Multiple WordPress Plugins - Arbitrary File Upload
CVE-2017-6104—webappsphp03 mar 2017
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.
23RIESGO
abrir ↗
Exploit-DB
EPSON TMNet WebConfig 1.00 - Cross-Site Scripting
CVE-2017-6443—webappshardware03 mar 2017
Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 allows remote attackers to inject arbitrary web s
23RIESGO
abrir ↗
Exploit-DB
WordPress Core < 4.7.1 - Username Enumeration
CVE-2017-5487—webappsphp03 mar 2017
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before
45RIESGO
abrir ↗
Exploit-DB
Multiple WordPress Plugins - Arbitrary File Upload
CVE-2017-1002001—webappsphp03 mar 2017
Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS so
28RIESGO
abrir ↗
Exploit-DB
Multiple WordPress Plugins - Arbitrary File Upload
CVE-2017-1002002—webappsphp03 mar 2017
Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http:
28RIESGO
abrir ↗
Exploit-DB
Multiple WordPress Plugins - Arbitrary File Upload
CVE-2017-1002003—webappsphp03 mar 2017
Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulner
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Conext ComBox 865-1058 - Denial of Service
CVE-2017-6019—doshardware02 mar 2017
An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830
35RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting
CVE-2016-8527—webappsxml01 mar 2017
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). Th
43RIESGO
abrir ↗
Exploit-DB
D-Link DSL-2730U Wireless N 150 - Cross-Site Request Forgery
CVE-2017-6411—webappshardware01 mar 2017
Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers to change the DNS or fi
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting
CVE-2016-8526—webappsxml01 mar 2017
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a
28RIESGO
abrir ↗
Exploit-DB
Synchronet BBS 3.16c - Denial of Service
CVE-2017-6371—doswindows28 feb 2017
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string
23RIESGO
abrir ↗
Exploit-DB
Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery
CVE-2017-6366—webappshardware28 feb 2017
Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 all
23RIESGO
abrir ↗
Exploit-DB
Cisco AnyConnect Secure Mobility Client 4.3.04027 - Local Privilege Escalation
CVE-2017-3813—localwindows28 feb 2017
A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows c
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Sophos Web Appliance 4.3.1.1 - Session Fixation
CVE-2017-6412—webappsphp28 feb 2017
In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.
23RIESGO
abrir ↗
Exploit-DB
Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery
CVE-2017-6334HIGHbajo ataquewebappshardware28 feb 2017
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute ar
100RIESGO
abrir ↗
Exploit-DB
WePresent WiPG-1500 - Backdoor Account
CVE-2017-6351—remotehardware27 feb 2017
The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password
23RIESGO
abrir ↗
Exploit-DB
Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free Privilege Escalation
CVE-2017-6074—locallinux26 feb 2017
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST p
23RIESGO
abrir ↗
Exploit-DB
Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free (PoC)
CVE-2017-6074—doslinux26 feb 2017
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST p
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Netgear DGN2200v1/v2/v3/v4 - 'dnslookup.cgi' Remote Command Execution
CVE-2017-6334HIGHbajo ataquewebappshardware25 feb 2017
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute ar
100RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Apple WebKit 10.0.2 - Cross-Origin or Sandboxed IFRAME Pop-up Blocker Bypass
CVE-2017-2371—webappsmultiple24 feb 2017
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" compon
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Apple WebKit 10.0.2 - 'Frame::setDocument' Universal Cross-Site Scripting
CVE-2017-2365—webappsmultiple24 feb 2017
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Apple WebKit 10.0.2 - 'FrameLoader::clear' Universal Cross-Site Scripting
CVE-2017-2363—webappsmacos24 feb 2017
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS
23RIESGO
abrir ↗
← anteriorpágina 152 / 817siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.