Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.062exploits catalogados

31.617CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.467Referência 19.791GitHub PoC 13.086VulnCheck XDB 8069Nuclei 4187Metasploit 3462✓ solo verificadosrecientes populares riesgo

4187 exploits

Nucleimedium

Zimbra Collaboration Suite - Cross-site Scripting

CVE-2018-6882MEDIUMbajo ataqueransomware

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Sui

63RIESGO

abrir ↗

Nucleihigh

DedeCMS 5.7 - Path Disclosure

CVE-2018-6910—

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/in

23RIESGO

abrir ↗

Nucleicritical

VMware NSX SD-WAN Edge - Command Injection

CVE-2018-6961HIGHbajo ataque

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web U

100RIESGO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7192—

Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remot

18RIESGO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7193—

Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attac

18RIESGO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7196—

Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers

18RIESGO

abrir ↗

Nucleicritical

Anchor CMS 0.12.3 - Error Log Exposure

CVE-2018-7251—

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contain

60RIESGO

abrir ↗

Nucleicritical

TITool PrintMonitor - Blind SQL Injection

CVE-2018-7282—

The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based b

23RIESGO

abrir ↗

Nucleicritical

Joomla! Component PrayerCenter 3.0.2 - SQL Injection

CVE-2018-7314—

SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerabil

50RIESGO

abrir ↗

Nucleihigh

WordPress Site Editor <=1.1.1 - Local File Inclusion

CVE-2018-7422—

A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to re

50RIESGO

abrir ↗

Nucleihigh

AxxonSoft Axxon Next - Local File Inclusion

CVE-2018-7467—

AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI.

23RIESGO

abrir ↗

Nucleihigh

uWSGI PHP Plugin Local File Inclusion

CVE-2018-7490—

uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversa

50RIESGO

abrir ↗

Nucleicritical

Drupal - Remote Code Execution

CVE-2018-7600CRITICALbajo ataqueransomware

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RIESGO

abrir ↗

Nucleicritical

Drupal - Remote Code Execution

CVE-2018-7602CRITICALbajo ataqueransomware

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

100RIESGO

abrir ↗

Nucleimedium

YzmCMS v3.6 - Cross-Site Scripting

CVE-2018-7653—

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.

38RIESGO

abrir ↗

Nucleimedium

CouchCMS <= 2.0 - Path Disclosure

CVE-2018-7662—

Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.fun

30RIESGO

abrir ↗

Nucleihigh

DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution

CVE-2018-7700—

DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php

40RIESGO

abrir ↗

Nucleihigh

Acrolinx Server <5.2.5 - Local File Inclusion

CVE-2018-7719—

Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.

50RIESGO

abrir ↗

Nucleihigh

Schneider Electric U.motion Builder - SQL Injection

CVE-2018-7765—

The vulnerability exists within processing of track_import_export.php in Schneider Electric U.motion Builder software ve

18RIESGO

abrir ↗

Nucleicritical

Schneider Electric U.motion Builder - Remote Code Execution

CVE-2018-7841CRITICALbajo ataque

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code

100RIESGO

abrir ↗

Nucleimedium

Apache ActiveMQ <=5.15.5 - Cross-Site Scripting

CVE-2018-8006—

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console

30RIESGO

abrir ↗

Nucleimedium

Apache Spark UI - Cross-Site Scripting

CVE-2018-8024—

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointin

18RIESGO

abrir ↗

Nucleihigh

Apache OFBiz - XML External Entity Injection

CVE-2018-8033—

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles re

23RIESGO

abrir ↗

Nucleihigh

AppWeb - Authentication Bypass

CVE-2018-8715—

The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in

23RIESGO

abrir ↗

Nucleimedium

WordPress WP Security Audit Log 3.1.1 - Information Disclosure

CVE-2018-8719—

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-securit

43RIESGO

abrir ↗

Nucleihigh

Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion

CVE-2018-8727—

Path Traversal in Gateway in Mirasys DVMS Workstation 5.12.6 and earlier allows an attacker to traverse the file system

18RIESGO

abrir ↗

Nucleimedium

Cobub Razor 0.8.0 - Information Disclosure

CVE-2018-8770—

Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, contro

50RIESGO

abrir ↗

Nucleicritical

PrestaShop Responsive Mega Menu Module - Remote Code Execution

CVE-2018-8823—

modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for Pre

30RIESGO

abrir ↗

Nucleihigh

WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion

CVE-2018-9118—

exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Direct

50RIESGO

abrir ↗

Nucleicritical

PrismaWEB - Credentials Disclosure

CVE-2018-9161—

Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the

30RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.