Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

85.821exploits catalogados

40.029CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 25.954Exploit-DB 24.488GitHub PoC 17.436VulnCheck XDB 9888Nuclei 4527Metasploit 3528✓ solo verificadosrecientes populares riesgo

24.488 exploits

Exploit-DB

CacheGuard-OS 5.7.7 - Cross-Site Request Forgery

CVE-2014-4865—webappslinux15 sep 2014

Cross-site request forgery (CSRF) vulnerability in gui/password-wadmin.apl in CacheGuard OS 5.7.7 allows remote attacker

23RIESGO

Exploit-DB✓ VexDay Proof

Railo 4.2.1 - Remote File Inclusion (Metasploit)

CVE-2014-5468—remotemultiple15 sep 2014

A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cf

50RIESGO

Exploit-DB✓ VexDay Proof

Aztech Modem Routers - Information Disclosure

CVE-2014-6437—remotehardware15 sep 2014

Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configurat

28RIESGO

Exploit-DB✓ VexDay Proof

Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)

CVE-2014-6287CRITICALbajo ataqueremotewindows15 sep 2014

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RIESGO

Exploit-DB✓ VexDay Proof

ManageEngine Desktop Central StatusUpdate - Arbitrary File Upload (Metasploit)

CVE-2014-5006—remotewindows09 sep 2014

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers

28RIESGO

Exploit-DB✓ VexDay Proof

ManageEngine Desktop Central StatusUpdate - Arbitrary File Upload (Metasploit)

CVE-2014-5005—remotewindows09 sep 2014

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers

60RIESGO

Exploit-DB

phpMyFAQ 2.8.x - Multiple Vulnerabilities

CVE-2014-6047—webappsphp08 sep 2014

phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by lever

23RIESGO

Exploit-DB

phpMyFAQ 2.8.x - Multiple Vulnerabilities

CVE-2014-6049—webappsphp08 sep 2014

phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted ins

23RIESGO

Exploit-DB

phpMyFAQ 2.8.x - Multiple Vulnerabilities

CVE-2014-6050—webappsphp08 sep 2014

phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request.

23RIESGO

Exploit-DB

phpMyFAQ 2.8.x - Multiple Vulnerabilities

CVE-2014-6045—webappsphp08 sep 2014

SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to exec

23RIESGO

Exploit-DB

phpMyFAQ 2.8.x - Multiple Vulnerabilities

CVE-2014-6048—webappsphp08 sep 2014

phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.

23RIESGO

Exploit-DB

phpMyFAQ 2.8.x - Multiple Vulnerabilities

CVE-2014-6046—webappsphp08 sep 2014

Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack th

23RIESGO

Exploit-DB

Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities

CVE-2014-2008—webappsphp08 sep 2014

SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attacker

23RIESGO

Exploit-DB

Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities

CVE-2014-2009—webappsphp08 sep 2014

The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path

23RIESGO

Exploit-DB

PhpOnlineChat 3.0 - Cross-Site Scripting

CVE-2014-100017—webappsphp07 sep 2014

Cross-site scripting (XSS) vulnerability in canned_opr.php in PhpOnlineChat 3.0 allows remote attackers to inject arbitr

23RIESGO

Exploit-DB

LoadedCommerce7 - Systemic Query Factory

CVE-2014-5140—webappsphp07 sep 2014

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly ha

23RIESGO

Exploit-DB✓ VexDay Proof

BulletProof FTP Client 2010 - Buffer Overflow (SEH)

CVE-2014-2973—doswindows05 sep 2014

35RIESGO

Exploit-DB✓ VexDay Proof

Mozilla Firefox 9.0.1 / Thunderbird 3.1.20 - Information Disclosure

CVE-2014-1564—remotemultiple02 sep 2014

Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize m

23RIESGO

Exploit-DB

Syslog LogAnalyzer 3.6.5 - Persistent Cross-Site Scripting

CVE-2014-6070—webappsmultiple02 sep 2014

Multiple cross-site scripting (XSS) vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject

23RIESGO

Exploit-DB

WordPress Plugin Huge-IT Image Gallery 1.0.1 - (Authenticated) SQL Injection

CVE-2014-7153—webappsphp02 sep 2014

SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.

23RIESGO

Exploit-DB

ManageEngine EventLog Analyzer - Multiple Vulnerabilities (1)

CVE-2014-6043—webappsjsp01 sep 2014

ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database

28RIESGO

Exploit-DB

ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution

CVE-2014-5007—webappsjsp01 sep 2014

Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop

35RIESGO

Exploit-DB

WordPress Plugin Slideshow Gallery 1.4.6 - Arbitrary File Upload

CVE-2014-5460—webappsphp01 sep 2014

Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remot

60RIESGO

Exploit-DB✓ VexDay Proof

Mulitple WordPress Themes - 'admin-ajax.php?img' Arbitrary File Download

CVE-2014-9734—webappsphp01 sep 2014

Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote att

28RIESGO

Exploit-DB✓ VexDay Proof

Wing FTP Server - (Authenticated) Command Execution (Metasploit)

CVE-2015-4107—remotewindows01 sep 2014

20RIESGO

Exploit-DB

ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution

CVE-2013-7390—webappsjsp01 sep 2014

Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before buil

60RIESGO

Exploit-DB

ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution

CVE-2014-5006—webappsjsp01 sep 2014

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers

28RIESGO

Exploit-DB

ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution

CVE-2014-5005—webappsjsp01 sep 2014

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers

60RIESGO

Exploit-DB✓ VexDay Proof

Mulitple WordPress Themes - 'admin-ajax.php?img' Arbitrary File Download

CVE-2015-1579—webappsphp01 sep 2014

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitra

43RIESGO

Exploit-DB

ManageEngine EventLog Analyzer - Multiple Vulnerabilities (1)

CVE-2014-6037—webappsjsp01 sep 2014

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8

60RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.