Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
85.833exploits catalogados
40.030CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 25.956Exploit-DB 24.488GitHub PoC 17.446VulnCheck XDB 9888Nuclei 4527Metasploit 3528✓ solo verificadosrecientespopularesriesgo
24.488 exploits
Exploit-DB
F5 Big-IP - rsync Access
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before
23RIESGO
abrir ↗Exploit-DB
NRPE 2.15 - Remote Code Execution
Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote atta
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox - WebIDL Privileged JavaScript Injection (Metasploit)
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin ShortCode 0.2.3 - Local File Inclusion
Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress
28RIESGO
abrir ↗Exploit-DB
XRms - Blind SQL Injection / Command Execution
plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary co
23RIESGO
abrir ↗Exploit-DB
Plogger 1.0-RC1 - (Authenticated) Arbitrary File Upload
Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authen
28RIESGO
abrir ↗Exploit-DB
Microsoft Internet Explorer - Memory Corruption (PoC) (MS14-029)
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service
28RIESGO
abrir ↗Exploit-DB
PhpWiki - Remote Command Execution
The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a dev
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox - WebIDL Privileged JavaScript Injection (Metasploit)
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
60RIESGO
abrir ↗Exploit-DB
ManageEngine DeviceExpert 5.9 - User Credential Disclosure
ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user acc
50RIESGO
abrir ↗Exploit-DB
XRms - Blind SQL Injection / Command Execution
SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
glibc - NUL Byte gconv_translit_find Off-by-One
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Granding MA300 - Traffic Sniffing Man In The Middle Fingerprint PIN Disclosure
Grand MA 300 allows retrieval of the access PIN from sniffed data.
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
VTLS Virtua InfoStation.cgi - SQL Injection
Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua bef
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Granding MA300 - Weak Pin Encryption Brute Force
Grand MA 300 allows a brute-force attack on the PIN.
23RIESGO
abrir ↗Exploit-DB
ntopng 1.2.0 - Cross-Site Scripting Injection
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 al
23RIESGO
abrir ↗Exploit-DB
Innovaphone PBX Admin-GUI - Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attack
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ManageEngine Password Manager - MetadataServlet.dat SQL Injection (Metasploit)
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
50RIESGO
abrir ↗Exploit-DB
LiveWorld Multiple Products - Cross Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in LiveWorld products, possibly including (1) LiveForum, (2) LiveQ&A
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ArticleFR - 'id' SQL Injection
Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execut
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ManageEngine Password Manager Pro / ManageEngine IT360 - SQL Injection
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manag
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WP Content Source Control - 'download.php' Directory Traversal
Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Sour
43RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox - toString console.time Privileged JavaScript Injection (Metasploit)
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbi
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Gitlab-shell - Code Execution (Metasploit)
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
50RIESGO
abrir ↗Exploit-DB
Tenda A5s Router 3.02.05_CN - Authentication Bypass
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox 4.3.6 - 3D Acceleration Virtual Machine Escape (Metasploit)
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/s
38RIESGO
abrir ↗Exploit-DB
VMTurbo Operations Manager 4.6 - 'vmtadmin.cgi' Remote Command Execution (Metasploit)
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands
60RIESGO
abrir ↗Exploit-DB
WordPress Plugin Disqus 2.7.5 - Cross-Site Request Forgery (Admin Persistent) / Cross-Site Scripting
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress
23RIESGO
abrir ↗Exploit-DB
WordPress Plugin Disqus 2.7.5 - Cross-Site Request Forgery (Admin Persistent) / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress al
23RIESGO
abrir ↗Exploit-DB
WordPress Plugin Disqus 2.7.5 - Cross-Site Request Forgery (Admin Persistent) / Cross-Site Scripting
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.