Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados

36.206CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientes populares riesgo

4320 exploits

Nucleicritical

vBulletin SQL Injection

CVE-2020-12720—

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.

40RIESGO

abrir ↗

Nucleicritical

WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution

CVE-2020-12800—

The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Uploa

60RIESGO

abrir ↗

Nucleicritical

WordPress Simple File List - Path Traversal

CVE-2020-12832—

WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files be

18RIESGO

abrir ↗

Nucleicritical

Wavlink Multiple AP - Remote Command Injection

CVE-2020-13117—

Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands

30RIESGO

abrir ↗

Nucleimedium

Submitty <= 20.04.01 - Open Redirect

CVE-2020-13121—

Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.

18RIESGO

abrir ↗

Nucleihigh

Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass

CVE-2020-13125HIGH

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the w

36RIESGO

abrir ↗

Nucleihigh

Artica Proxy Community Edition <4.30.000000 - Local File Inclusion

CVE-2020-13158—

Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parame

30RIESGO

abrir ↗

Nucleicritical

Netsweeper <=6.4.3 - Python Code Injection

CVE-2020-13167—

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain

40RIESGO

abrir ↗

Nucleimedium

Contentful <=2020-05-21 - Cross-Site Scripting

CVE-2020-13258—

Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.p

18RIESGO

abrir ↗

Nucleihigh

Grafana 3.0.1-7.0.1 - Server-Side Request Forgery

CVE-2020-13379—

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows

60RIESGO

abrir ↗

Nucleihigh

Microweber <1.1.20 - Information Disclosure

CVE-2020-13405—

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose

23RIESGO

abrir ↗

Nucleimedium

Bitrix24 <=20.0.0 - Cross-Site Scripting

CVE-2020-13483—

The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/

18RIESGO

abrir ↗

Nucleicritical

rConfig 3.9 - Authentication Bypass(Admin Login)

CVE-2020-13638—

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account cr

40RIESGO

abrir ↗

Nucleicritical

wpDiscuz <= 5.3.5 - SQL Injection

CVE-2020-13640—

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute

23RIESGO

abrir ↗

Nucleihigh

WordPress acf-to-rest-api <=3.1.0 - Insecure Direct Object Reference

CVE-2020-13700—

An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object r

23RIESGO

abrir ↗

Nucleimedium

Extreme Management Center 8.4.1.24 - Cross-Site Scripting

CVE-2020-13820—

Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.

18RIESGO

abrir ↗

Nucleihigh

Artica Pandora FMS 7.44 - Remote Code Execution

CVE-2020-13851—

Artica Pandora FMS 7.44 allows remote command execution via the events feature.

40RIESGO

abrir ↗

Nucleihigh

Intelbras TIP 200/200 LITE/300 - Local File Inclusion

CVE-2020-13886—

Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?pag

18RIESGO

abrir ↗

Nucleicritical

Airflow Experimental <1.10.11 - REST API Auth Bypass

CVE-2020-13927CRITICALbajo ataque

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th

100RIESGO

abrir ↗

Nucleimedium

Apache Kylin - Exposed Configuration File

CVE-2020-13937—

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.

40RIESGO

abrir ↗

Nucleicritical

Apache Unomi <1.5.2 - Remote Code Execution

CVE-2020-13942—

Remote Code Execution in Apache Unomi

50RIESGO

abrir ↗

Nucleimedium

Apache APISIX - Insufficiently Protected Credentials

CVE-2020-13945—

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the

40RIESGO

abrir ↗

Nucleicritical

WordPress PayPal Pro <1.1.65 - SQL Injection

CVE-2020-14092—

The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.

40RIESGO

abrir ↗

Nucleihigh

Gitea 1.1.0 - 1.12.5 - Remote Code Execution

CVE-2020-14144—

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir

40RIESGO

abrir ↗

Nucleimedium

Atlassian Jira Server/Data Center <8.5.8/8.6.0 - 8.11.1 - Information Disclosure

CVE-2020-14179—

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field

40RIESGO

abrir ↗

Nucleimedium

Jira Server and Data Center - Information Disclosure

CVE-2020-14181—

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Infor

60RIESGO

abrir ↗

Nucleimedium

Agentejo Cockpit 0.10.2 - Cross-Site Scripting

CVE-2020-14408—

An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login rou

18RIESGO

abrir ↗

Nucleimedium

NeDi 1.9C - Cross-Site Scripting

CVE-2020-14413—

NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function at

18RIESGO

abrir ↗

Nucleicritical

Oracle WebLogic Server - Remote Command Execution

CVE-2020-14750CRITICALbajo ataque

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RIESGO

abrir ↗

Nucleihigh

Oracle Fusion - Directory Traversal/Local File Inclusion

CVE-2020-14864HIGHbajo ataque

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.