Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.682exploits catalogados
39.953CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.887Exploit-DB 24.488GitHub PoC 17.378VulnCheck XDB 9888Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
24.488 exploits
Exploit-DB
Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
CVE-2014-3439—webappsjsp06 nov 2014
ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitr
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
X7 Chat 2.0.5 - 'message.php' PHP Code Execution (Metasploit)
CVE-2014-8998—remotephp06 nov 2014
lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a c
50RIESGO
abrir ↗
Exploit-DB
Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
CVE-2014-3438—webappsjsp06 nov 2014
Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager
23RIESGO
abrir ↗
Exploit-DB
ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)
CVE-2014-6038—webappsmultiple05 nov 2014
Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerabili
60RIESGO
abrir ↗
Exploit-DB
MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting
CVE-2014-8774—webappsphp05 nov 2014
Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attacke
23RIESGO
abrir ↗
Exploit-DB
ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)
CVE-2014-6039—webappsmultiple05 nov 2014
ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed versio
50RIESGO
abrir ↗
Exploit-DB
MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting
CVE-2014-8775—webappsphp05 nov 2014
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, whic
23RIESGO
abrir ↗
Exploit-DB
MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting
CVE-2014-8773—webappsphp05 nov 2014
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mec
23RIESGO
abrir ↗
Exploit-DB
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
CVE-2014-7227—webappsphp03 nov 2014
20RIESGO
abrir ↗
Exploit-DB
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
CVE-2014-3659—webappsphp03 nov 2014
20RIESGO
abrir ↗
Exploit-DB
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
CVE-2014-7169CRITICALbajo ataquewebappsphp03 nov 2014
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
100RIESGO
abrir ↗
Exploit-DB
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
CVE-2014-62771—webappsphp03 nov 2014
20RIESGO
abrir ↗
Exploit-DB
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
CVE-2014-3671—webappsphp03 nov 2014
20RIESGO
abrir ↗
Exploit-DB
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
CVE-2014-7910—webappsphp03 nov 2014
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o
23RIESGO
abrir ↗
Exploit-DB
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
CVE-2014-7196—webappsphp03 nov 2014
20RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Remote Code Execution)
CVE-2014-3704—webappsphp03 nov 2014
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗
Exploit-DB
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Admin Session)
CVE-2014-3704—webappsphp03 nov 2014
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗
Exploit-DB
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
CVE-2014-6271CRITICALbajo ataquewebappsphp03 nov 2014
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗
Exploit-DB
Who's Who Script - Cross-Site Request Forgery (Add Admin)
CVE-2014-8953—webappsphp31 oct 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in Php Scriptlerim Who's Who script allow remote attackers to
23RIESGO
abrir ↗
Exploit-DB
Progress OpenEdge 11.2 - Directory Traversal
CVE-2014-8555—webappsjsp31 oct 2014
Directory traversal vulnerability in report/reportViewAction.jsp in Progress Software OpenEdge 11.2 allows remote attack
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
CVE-2014-7910—remotelinux29 oct 2014
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o
23RIESGO
abrir ↗
Exploit-DB
Konke Smart Plug K - Authentication Bypass
CVE-2014-7279—remotehardware29 oct 2014
The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote attackers to obtain "equ
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
CVE-2014-7227—remotelinux29 oct 2014
20RIESGO
abrir ↗
Exploit-DB
IBM Tivoli Monitoring 6.2.2 kbbacf1 - Local Privilege Escalation
CVE-2013-5467—locallinux29 oct 2014
Monitoring Agent for UNIX Logs 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP04 and Mo
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
CVE-2014-3671—remotelinux29 oct 2014
20RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
MAARCH 1.4 - Arbitrary File Upload
CVE-2015-1587—webappsphp29 oct 2014
Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earl
50RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
CVE-2014-7169CRITICALbajo ataqueremotelinux29 oct 2014
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
100RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
CVE-2014-7196—remotelinux29 oct 2014
20RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
CVE-2014-3659—remotelinux29 oct 2014
20RIESGO
abrir ↗
Exploit-DB
Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - '.wax' File Buffer Overflow (Denial of Service) (PoC) EIP Overwrite
CVE-2014-9448—doswindows29 oct 2014
Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or
23RIESGO
abrir ↗
← anteriorpágina 212 / 817siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.