Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.114exploits catalogados

31.649CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.469Referência 19.810GitHub PoC 13.116VulnCheck XDB 8069Nuclei 4188Metasploit 3462✓ solo verificadosrecientes populares riesgo

4187 exploits

Nucleicritical

PHPSHE 1.7 - SQL Injection

CVE-2019-9762—

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnera

18RIESGO

abrir ↗

Nucleicritical

Sitecore Experience Platform - Deserialization of Untrusted Data

CVE-2019-9874CRITICALbajo ataque

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an

95RIESGO

abrir ↗

Nucleicritical

WPGraphQL 0.2.3 - User Creation

CVE-2019-9879—

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever

50RIESGO

abrir ↗

Nucleicritical

WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure

CVE-2019-9880—

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible,

50RIESGO

abrir ↗

Nucleimedium

WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting

CVE-2019-9881—

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on

43RIESGO

abrir ↗

Nucleimedium

WP Google Maps < 7.10.43 - Cross-Site Scripting

CVE-2019-9912—

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.

18RIESGO

abrir ↗

Nucleimedium

GetSimple CMS 3.3.13 - Open Redirect

CVE-2019-9915—

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter.

18RIESGO

abrir ↗

Nucleihigh

Joomla! Harmis Messenger 1.2.2 - Local File Inclusion

CVE-2019-9922MEDIUM

An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. Directory Traversal allows read access t

33RIESGO

abrir ↗

Nucleimedium

Zyxel - Cross-Site Scripting

CVE-2019-9955—

On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, U

43RIESGO

abrir ↗

Nucleimedium

WordPress Social Warfare <3.5.3 - Cross-Site Scripting

CVE-2019-9978MEDIUMbajo ataque

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RIESGO

abrir ↗

Nucleihigh

Microsoft SQL Server Reporting Services - Remote Code Execution

CVE-2020-0618CRITICALbajo ataque

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page

100RIESGO

abrir ↗

Nucleicritical

SolarWinds Orion API - Auth Bypass

CVE-2020-10148CRITICALbajo ataque

SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

100RIESGO

abrir ↗

Nucleicritical

ManageEngine Desktop Central Java Deserialization

CVE-2020-10189CRITICALbajo ataque

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted d

100RIESGO

abrir ↗

Nucleihigh

Sonatype Nexus Repository Manager 3 - Remote Code Execution

CVE-2020-10199HIGHbajo ataque

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

100RIESGO

abrir ↗

Nucleicritical

rConfig 3.9 - SQL Injection

CVE-2020-10220—

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php

60RIESGO

abrir ↗

Nucleicritical

ThemeREX Addons - Remote Code Execution

CVE-2020-10257CRITICAL

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST

43RIESGO

abrir ↗

Nucleicritical

WatchGuard Fireware AD Helper Component - Credentials Disclosure

CVE-2020-10532—

The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext password

18RIESGO

abrir ↗

Nucleicritical

rConfig 3.9.4 - SQL Injection

CVE-2020-10546—

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, n

40RIESGO

abrir ↗

Nucleicritical

rConfig 3.9.4 - SQL Injection

CVE-2020-10547—

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by defa

30RIESGO

abrir ↗

Nucleicritical

rConfig 3.9.4 - SQL Injection

CVE-2020-10548—

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passw

30RIESGO

abrir ↗

Nucleicritical

rConfig <=3.9.4 - SQL Injection

CVE-2020-10549—

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' pass

30RIESGO

abrir ↗

Nucleimedium

Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)

CVE-2020-10770—

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using

50RIESGO

abrir ↗

Nucleihigh

WAVLINK - Access Control

CVE-2020-10973—

An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/Ex

18RIESGO

abrir ↗

Nucleicritical

Tenda AC15 AC1900 version 15.03.05.19 - Command Injection

CVE-2020-10987CRITICALbajo ataque

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary s

100RIESGO

abrir ↗

Nucleimedium

GLPI <9.4.6 - Open Redirect

CVE-2020-11034MEDIUM

bypass of manageRedirect in GLPI

28RIESGO

abrir ↗

Nucleimedium

Grafana <= 6.7.1 - Cross-Site Scripting

CVE-2020-11110—

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an a

18RIESGO

abrir ↗

Nucleimedium

phpMyAdmin 5.0.2 - CRLF Injection

CVE-2020-11441—

phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF s

18RIESGO

abrir ↗

Nucleihigh

MicroStrategy Web 10.4 - Information Disclosure

CVE-2020-11450—

Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information throu

23RIESGO

abrir ↗

Nucleicritical

LimeSurvey 4.1.11 - Local File Inclusion

CVE-2020-11455—

LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileM

60RIESGO

abrir ↗

Nucleicritical

Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint

CVE-2020-11514—

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPres

18RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.