Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.682exploits catalogados
39.953CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.887Exploit-DB 24.488GitHub PoC 17.378VulnCheck XDB 9888Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
24.488 exploits
Exploit-DB
D-Link DSL-2730B Modem - Cross-Site Scripting Injection Stored DnsProxy.cmd
CVE-2015-1028—webappshardware11 ene 2015
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remo
23RIESGO
abrir ↗
Exploit-DB
D-Link DSL-2730B Modem - Cross-Site Scripting Injection Stored Wlsecrefresh.wl & Wlsecurity.wl
CVE-2015-1028—webappshardware11 ene 2015
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remo
23RIESGO
abrir ↗
Exploit-DB
D-Link DSL-2730B Modem - 'Lancfg2get.cgi Persistent Cross-Site Scripting
CVE-2015-1028—webappshardware11 ene 2015
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remo
23RIESGO
abrir ↗
Exploit-DB
Apple Mac OSX 10.9.x - sysmond XPC Privilege Escalation
CVE-2014-8835—localosx10 ene 2015
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes ke
23RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload
CVE-2014-9308—webappsphp08 ene 2015
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka Wor
50RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Pandora FMS 3.1 - Authentication Bypass / Arbitrary File Upload (Metasploit)
CVE-2010-4279—remotephp08 ene 2015
The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which al
50RIESGO
abrir ↗
Exploit-DB
Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure
CVE-2015-0554—webappshardware07 ene 2015
The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly rest
50RIESGO
abrir ↗
Exploit-DB
Sefrengo CMS 1.6.0 - SQL Injection
CVE-2015-0919—webappsphp07 ene 2015
Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrator
23RIESGO
abrir ↗
Exploit-DB
Microweber CMS 0.95 - SQL Injection
CVE-2014-9464—webappsphp07 ene 2015
SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute ar
23RIESGO
abrir ↗
Exploit-DB
AdaptCMS 3.0.3 - Multiple Vulnerabilities
CVE-2015-1058—webappsphp06 ene 2015
Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web scr
23RIESGO
abrir ↗
Exploit-DB
AdaptCMS 3.0.3 - Multiple Vulnerabilities
CVE-2015-1059—webappsphp06 ene 2015
Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute
23RIESGO
abrir ↗
Exploit-DB
AdaptCMS 3.0.3 - Multiple Vulnerabilities
CVE-2015-1060—webappsphp06 ene 2015
Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
BulletProof FTP Client - BPS Buffer Overflow (Metasploit)
CVE-2014-2973—localwindows06 ene 2015
35RIESGO
abrir ↗
Exploit-DB
Nexus 5 Android 5.0 - Local Privilege Escalation
CVE-2014-4322—localandroid06 ene 2015
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Andr
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
OP5 5.3.5/5.4.0/5.4.2/5.5.0/5.5.1 - 'welcome' Remote Command Execution (Metasploit)
CVE-2012-0262—webappsmultiple05 ene 2015
op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers
60RIESGO
abrir ↗
Exploit-DB
SkinCrafter3 vs2005 3.8.1.0 - Multiple ActiveX Buffer Overflows
CVE-2012-2271—remotewindows05 ene 2015
Buffer overflow in the InitLicenKeys function in a certain ActiveX control in SkinCrafter3_vs2005.dll in SkinCrafter 3.0
23RIESGO
abrir ↗
Exploit-DB
Crea8Social 2.0 - Cross-Site Scripting Change Interface
CVE-2015-1054—webappsphp04 ene 2015
Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to in
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
ASUSWRT 3.0.0.4.376_1071 - LAN Backdoor Command Execution
CVE-2014-9583—remotehardware04 ene 2015
common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC
60RIESGO
abrir ↗
Exploit-DB
PhotoPost < 4.85 - Multiple Vulnerabilities
CVE-2005-0273—webappsphp03 ene 2015
Multiple SQL injection vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to execute arb
23RIESGO
abrir ↗
Exploit-DB
PhotoPost < 4.85 - Multiple Vulnerabilities
CVE-2005-0274—webappsphp03 ene 2015
Multiple cross-site scripting (XSS) vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers t
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
e107 2 Bootstrap CMS - Cross-Site Scripting
CVE-2015-1057—webappsphp03 ene 2015
Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary w
23RIESGO
abrir ↗
Exploit-DB
ReviewPost < 2.84 - Multiple Vulnerabilities
CVE-2005-0271—webappsphp02 ene 2015
Multiple SQL injection vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to execute arbitrary SQL
23RIESGO
abrir ↗
Exploit-DB
ReviewPost < 2.84 - Multiple Vulnerabilities
CVE-2005-0270—webappsphp02 ene 2015
Multiple cross-site scripting (XSS) vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to inject a
23RIESGO
abrir ↗
Exploit-DB
ReviewPost < 2.84 - Multiple Vulnerabilities
CVE-2005-0272—webappsphp02 ene 2015
ReviewPost PHP Pro before 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review fil
23RIESGO
abrir ↗
Exploit-DB
Absolut Engine 1.73 - Multiple Vulnerabilities
CVE-2014-9435—webappsphp01 ene 2015
Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL
23RIESGO
abrir ↗
Exploit-DB
Absolut Engine 1.73 - Multiple Vulnerabilities
CVE-2014-9434—webappsphp01 ene 2015
Cross-site scripting (XSS) vulnerability in admin/managerrelated.php in the administrative backend in Absolut Engine 1.7
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows 8.1 (x86/x64) - 'ahcache.sys' NtApphelpCacheControl Privilege Escalation
CVE-2015-0002—localwindows01 ene 2015
The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1,
43RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Social Microblogging PRO 1.5 - Persistent Cross-Site Scripting
CVE-2014-9516—webappsphp31 dic 2014
Cross-site scripting (XSS) vulnerability in Social Microblogging PRO 1.5 allows remote attackers to inject arbitrary web
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
ProjectSend - Arbitrary File Upload (Metasploit)
CVE-2014-9567—remotephp31 dic 2014
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows rem
50RIESGO
abrir ↗
Exploit-DB
PHP-Calendar < 0.10.1 - Arbitrary File Inclusion
CVE-2004-1423—webappsphp29 dic 2014
Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth o
28RIESGO
abrir ↗
← anteriorpágina 206 / 817siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.