Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

75.445exploits catalogados
34.432CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.443Referência 21.497GitHub PoC 13.627VulnCheck XDB 8198Nuclei 4217Metasploit 3463✓ solo verificadosrecientespopularesriesgo
24.443 exploits
Exploit-DB
Sphider Search Engine - Multiple Vulnerabilities
CVE-2014-5084—webappsphp02 ago 2014
A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let
23RIESGO
abrir ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5091—webappsphp02 ago 2014
A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, wh
28RIESGO
abrir ↗
Exploit-DB
ArticleFR 11.06.2014 - 'data.php' Privilege Escalation
CVE-2014-4170—webappsphp02 ago 2014
A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restric
28RIESGO
abrir ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5090—webappsphp02 ago 2014
admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell me
23RIESGO
abrir ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5094—webappsphp02 ago 2014
Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.p
23RIESGO
abrir ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5092—webappsphp02 ago 2014
Status2k allows Remote Command Execution in admin/options/editpl.php.
23RIESGO
abrir ↗
Exploit-DB
Status2k Server Monitoring Software - Multiple Vulnerabilities
CVE-2014-5093—webappsphp02 ago 2014
Status2k does not remove the install directory allowing credential reset.
23RIESGO
abrir ↗
Exploit-DB
D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery / Denial of Service
CVE-2014-3136—doshardware30 jul 2014
Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote a
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
CVE-2014-5082—webappsphp28 jul 2014
Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus al
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin Lead Octopus Power - 'id' SQL Injection
CVE-2014-5189—webappsphp28 jul 2014
SQL injection vulnerability in lib/optin/optin_page.php in the Lead Octopus plugin for WordPress allows remote attackers
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin FB Gorilla - 'game_play.php' SQL Injection
CVE-2014-5200—webappsphp28 jul 2014
SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute a
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin WhyDoWork AdSense - 'options-general.php' Cross-Site Request Forgery (Option Manipulation)
CVE-2014-9099—webappsphp28 jul 2014
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attacker
23RIESGO
abrir ↗
Exploit-DB
Ubiquiti UbiFi / mFi / AirVision - Cross-Site Request Forgery
CVE-2014-2225—webappshardware28 jul 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remo
23RIESGO
abrir ↗
Exploit-DB
Oxwall 1.7.0 - Multiple Cross-Site Request Forgery / HTML Injection Vulnerabilities
CVE-2014-9101—webappsphp28 jul 2014
Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (b
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
CVE-2014-5193—webappsphp28 jul 2014
Cross-site scripting (XSS) vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
CVE-2014-5192—webappsphp28 jul 2014
SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL command
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Sphider Search Engine 1.3.6 - Multiple Vulnerabilities
CVE-2014-5194—webappsphp28 jul 2014
Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbi
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
DirPHP 1.0 - Local File Inclusion
CVE-2014-5115—webappsphp27 jul 2014
Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname
23RIESGO
abrir ↗
Exploit-DB
Moodle 2.7 - Persistent Cross-Site Scripting
CVE-2014-3544—webappsphp27 jul 2014
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before
23RIESGO
abrir ↗
Exploit-DB
ZeroCMS 1.0 - Persistent Cross-Site Scripting
CVE-2014-4710—webappsphp27 jul 2014
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbit
23RIESGO
abrir ↗
Exploit-DB
Pligg CMS 2.0.1 - Multiple Vulnerabilities
CVE-2014-9096—webappsphp25 jul 2014
Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute a
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation (Metasploit)
CVE-2014-4971—localwindows_x8625 jul 2014
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RIESGO
abrir ↗
Exploit-DB
Zenoss Monitoring System 4.2.5-2108 (x64) - Persistent Cross-Site Scripting
CVE-2014-3738—webappsmultiple25 jul 2014
Cross-site scripting (XSS) vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML
23RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Video Gallery 2.5 - Multiple Vulnerabilities
CVE-2014-9097—webappsphp24 jul 2014
Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly
23RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Video Gallery 2.5 - Multiple Vulnerabilities
CVE-2014-9098—webappsphp24 jul 2014
Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
BulletProof FTP Client 2010 - Buffer Overflow (SEH) (PoC)
CVE-2014-2973—doswindows24 jul 2014
35RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Ilya Birman E2 - '/@actions/comment-process' SQL Injection
CVE-2014-4736—webappsphp23 jul 2014
SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the no
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Ubiquiti Networks UniFi Video Default - 'crossdomain.xml' Security Bypass
CVE-2014-2227—webappsphp23 jul 2014
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVisi
23RIESGO
abrir ↗
Exploit-DB
Raritan PowerIQ 4.1.0 - SQL Injection (Metasploit)
CVE-2014-9095—webappslinux21 jul 2014
Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Exploit-DB
Apache 2.4.7 mod_status - Scoreboard Handling Race Condition
CVE-2014-0226—doslinux21 jul 2014
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
45RIESGO
abrir ↗
← anteriorpágina 220 / 815siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.