Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.682exploits catalogados
39.953CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.887Exploit-DB 24.488GitHub PoC 17.378VulnCheck XDB 9888Nuclei 4513Metasploit 3528✓ solo verificadosrecientespopularesriesgo
24.488 exploits
Exploit-DB✓ VexDay Proof
Microsoft Windows - OLE Package Manager Code Execution (MS14-060) (Metasploit)
CVE-2014-4114HIGHbajo ataquelocalwindows_x8620 oct 2014
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
100RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Linux PolicyKit - Race Condition Privilege Escalation (Metasploit)
CVE-2011-1485—locallinux20 oct 2014
Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privil
38RIESGO
abrir ↗
Exploit-DB
Aireplay-ng 1.2 beta3 - 'tcp_test' Length Stack Overflow
CVE-2014-8322—remotelinux20 oct 2014
Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attac
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - OLE Package Manager Code Execution (MS14-060) (Metasploit)
CVE-2014-6352HIGHbajo ataquelocalwindows_x8620 oct 2014
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
100RIESGO
abrir ↗
Exploit-DB
Microsoft Windows - OLE Package Manager SandWorm
CVE-2014-6352HIGHbajo ataquelocalwindows20 oct 2014
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
100RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
SAP NetWeaver Enqueue Server - Denial of Service
CVE-2014-0995—doswindows17 oct 2014
The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of serv
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)
CVE-2014-3704—webappsphp17 oct 2014
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)
CVE-2014-3704—webappsphp17 oct 2014
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)
CVE-2014-3704—webappsphp16 oct 2014
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Bluetooth Personal Area Networking - 'BthPan.sys' Local Privilege Escalation (Metasploit)
CVE-2014-4971—localwindows_x8615 oct 2014
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Centreon < 2.5.1 / Centreon Enterprise Server < 2.2 - SQL Injection / Command Injection (Metasploit)
CVE-2014-3828—webappslinux15 oct 2014
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Centreon < 2.5.1 / Centreon Enterprise Server < 2.2 - SQL Injection / Command Injection (Metasploit)
CVE-2014-3829—webappslinux15 oct 2014
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remot
60RIESGO
abrir ↗
Exploit-DB
Croogo 2.0.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities
CVE-2014-8577—webappsphp14 oct 2014
Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary we
23RIESGO
abrir ↗
Exploit-DB
Tenda A32 Router - Cross-Site Request Forgery
CVE-2014-7281—webappshardware14 oct 2014
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN a
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
YourMembers Plugin - Blind SQL Injection
CVE-2014-100003—webappsphp14 oct 2014
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for Wor
23RIESGO
abrir ↗
Exploit-DB
vBulletin 4.x/5.x - AdminCP/ApiLog via xmlrpc API (Authenticated) Persistent Cross-Site Scripting
CVE-2014-2021—webappsphp12 oct 2014
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 a
23RIESGO
abrir ↗
Exploit-DB
Pimcore CMS 1.4.9 <2.1.0 - Multiple Vulnerabilities
CVE-2014-2921—webappshardware12 oct 2014
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 doe
23RIESGO
abrir ↗
Exploit-DB
CMS Made Simple 1.11.9 - Multiple Vulnerabilities
CVE-2014-0334—webappsphp12 oct 2014
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitr
23RIESGO
abrir ↗
Exploit-DB
Pimcore CMS 1.4.9 <2.1.0 - Multiple Vulnerabilities
CVE-2014-2922—webappshardware12 oct 2014
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 doe
23RIESGO
abrir ↗
Exploit-DB
GetSimple CMS 3.3.1 - Cross-Site Scripting
CVE-2014-1603—webappsphp12 oct 2014
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary we
23RIESGO
abrir ↗
Exploit-DB
vBulletin 4.x - breadcrumbs via xmlrpc API (Authenticated) SQL Injection
CVE-2014-2022—webappsphp12 oct 2014
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier a
23RIESGO
abrir ↗
Exploit-DB
Linux Kernel < 3.16.1 - 'Remount FUSE' Local Privilege Escalation
CVE-2014-5207—locallinux09 oct 2014
fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOE
23RIESGO
abrir ↗
Exploit-DB
BMC Track-It! - Multiple Vulnerabilities
CVE-2014-4874—webappswindows09 oct 2014
BMC Track-It! 11.3.0.355 allows remote authenticated users to read arbitrary files by visiting the TrackItWeb/Attachment
23RIESGO
abrir ↗
Exploit-DB
BMC Track-It! - Multiple Vulnerabilities
CVE-2014-4873—webappswindows09 oct 2014
SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.355 allows remote authenticated users to
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Rejetto HTTP File Server (HFS) - Remote Command Execution (Metasploit)
CVE-2014-6287CRITICALbajo ataqueremotewindows09 oct 2014
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RIESGO
abrir ↗
Exploit-DB
BMC Track-It! - Multiple Vulnerabilities
CVE-2014-4872—webappswindows09 oct 2014
BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbit
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
F5 iControl - Remote Command Execution (Metasploit)
CVE-2014-2928—remoteunix09 oct 2014
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5
50RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin InfusionSoft - Arbitrary File Upload (Metasploit)
CVE-2014-6446—remotephp09 oct 2014
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows
50RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Nessus Web UI 2.3.3 - Persistent Cross-Site Scripting
CVE-2014-7280—webappsmultiple09 oct 2014
Cross-site scripting (XSS) vulnerability in the Web UI before 2.3.4 Build #85 for Tenable Nessus 5.x allows remote web s
23RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Creative Contact Form 0.9.7 - Arbitrary File Upload
CVE-2014-7969—webappsphp08 oct 2014
20RIESGO
abrir ↗
← anteriorpágina 214 / 817siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.