Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.682exploits catalogados
39.953CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.887Exploit-DB 24.488GitHub PoC 17.378VulnCheck XDB 9888Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
24.488 exploits
Exploit-DB
WordPress Core < 4.0.1 - Denial of Service
CVE-2014-9034—dosphp01 dic 2014
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 all
45RIESGO
abrir ↗
Exploit-DB
Drupal < 7.34 - Denial of Service
CVE-2014-9016—dosphp01 dic 2014
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x
60RIESGO
abrir ↗
Exploit-DB
WordPress Core 4.0 - Denial of Service
CVE-2014-9034—dosphp01 dic 2014
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 all
45RIESGO
abrir ↗
Exploit-DB
CCH Wolters Kluwer PFX Engagement 7.1 - Local Privilege Escalation
CVE-2014-9113—localwindows28 nov 2014
CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Use
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin DB Backup - Arbitrary File Download
CVE-2014-9119—webappsphp26 nov 2014
Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote at
43RIESGO
abrir ↗
Exploit-DB
xEpan 1.0.1 - Cross-Site Request Forgery
CVE-2014-8429—webappsphp26 nov 2014
Cross-site request forgery (CSRF) vulnerability in Xavoc Technocrats xEpan CMS 1.0.4.1, 1.0.4, 1.0.1, and earlier allows
23RIESGO
abrir ↗
Exploit-DB
Android WAPPushManager - SQL Injection
CVE-2014-8507—dosandroid26 nov 2014
Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/Wap
23RIESGO
abrir ↗
Exploit-DB
Elipse E3 - HTTP Denial of Service
CVE-2014-8652—doswindows26 nov 2014
Elipse E3 3.x and earlier allows remote attackers to cause a denial of service (application crash and plant outage) via
23RIESGO
abrir ↗
Exploit-DB
Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - '.wax' Local Buffer Overflow (SEH)
CVE-2014-9448—localwindows26 nov 2014
Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or
23RIESGO
abrir ↗
Exploit-DB
TRENDnet SecurView Wireless Network Camera TV-IP422WN - 'UltraCamX.ocx' Stack Buffer Overflow (PoC)
CVE-2014-10011—doswindows25 nov 2014
Stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView ca
28RIESGO
abrir ↗
Exploit-DB
Linux Kernel 3.14.5 (CentOS 7 / RHEL) - 'libfutex' Local Privilege Escalation
CVE-2014-3153HIGHbajo ataquelocallinux25 nov 2014
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two diff
98RIESGO
abrir ↗
Exploit-DB
Arris VAP2500 - Authentication Bypass
CVE-2014-8425—webappshardware25 nov 2014
The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the confi
23RIESGO
abrir ↗
Exploit-DB
Arris VAP2500 - Authentication Bypass
CVE-2014-8423—webappshardware25 nov 2014
Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute ar
50RIESGO
abrir ↗
Exploit-DB
Arris VAP2500 - Authentication Bypass
CVE-2014-8424—webappshardware25 nov 2014
ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authenticatio
50RIESGO
abrir ↗
Exploit-DB
PHPMyRecipes 1.2.2 - 'dosearch.php?words_exact' SQL Injection
CVE-2014-9347—webappsphp25 nov 2014
SQL injection vulnerability in dosearch.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL comma
23RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Google Document Embedder 2.5.14 - SQL Injection
CVE-2014-9173—webappsphp25 nov 2014
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote atta
23RIESGO
abrir ↗
Exploit-DB
TP-Link TL-WR740N - Denial of Service
CVE-2014-9350—doshardware24 nov 2014
TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attack
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Hikvision DVR - RTSP Request Remote Code Execution (Metasploit)
CVE-2014-4880—remotelinux24 nov 2014
Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote atta
60RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Download Manager 2.7.2 - Privilege Escalation
CVE-2014-9260—webappsphp24 nov 2014
The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users
28RIESGO
abrir ↗
Exploit-DB
WordPress Plugin wpDataTables 1.5.3 - SQL Injection
CVE-2014-9175—webappsphp24 nov 2014
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote
23RIESGO
abrir ↗
Exploit-DB
Microsoft Windows 8.1/ Server 2012 - 'Win32k.sys' Local Privilege Escalation (MS14-058)
CVE-2014-4113HIGHbajo ataquelocalwindows24 nov 2014
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 a
100RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Advantech EKI-6340 - Command Injection
CVE-2014-8387—webappscgi24 nov 2014
cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrar
35RIESGO
abrir ↗
Exploit-DB
WordPress Plugin DukaPress 2.5.2 - Directory Traversal
CVE-2014-8799—webappsphp24 nov 2014
Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2
50RIESGO
abrir ↗
Exploit-DB
RobotStats 1.0 - HTML Injection
CVE-2014-9349—dosaix24 nov 2014
Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to
23RIESGO
abrir ↗
Exploit-DB
RobotStats 1.0 - 'robot' SQL Injection
CVE-2014-9348—webappsphp24 nov 2014
SQL injection vulnerability in the formulaireRobot function in admin/robots.lib.php in RobotStats 1.0 allows remote atta
23RIESGO
abrir ↗
Exploit-DB
tcpdump 4.6.2 - Geonet Decoder Denial of Service
CVE-2014-8768—dosmultiple24 nov 2014
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow rem
28RIESGO
abrir ↗
Exploit-DB
WordPress Plugin CM Download Manager 2.0.0 - Code Injection
CVE-2014-8877—webappsphp22 nov 2014
The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plug
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin SP Client Document Manager 2.4.1 - SQL Injection
CVE-2014-9178—webappsphp21 nov 2014
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plu
23RIESGO
abrir ↗
Exploit-DB
FluxBB < 1.5.6 - SQL Injection
CVE-2014-10029—webappsmultiple21 nov 2014
SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to exe
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution / PowerShell VirtualAlloc (MS14-064)
CVE-2014-6332HIGHbajo ataqueremotewindows20 nov 2014
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RIESGO
abrir ↗
← anteriorpágina 209 / 817siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.