Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
78.958exploits catalogados
36.206CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientespopularesriesgo
24.458 exploits
Exploit-DB
AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)
Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote aut
23RIESGO
abrir ↗Exploit-DB
Wordpress Plugin XCloner 4.2.12 - Remote Code Execution (Authenticated)
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated atta
53RIESGO
abrir ↗Exploit-DB
ES File Explorer 4.1.9.7.4 - Arbitrary File Read
The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary fi
50RIESGO
abrir ↗Exploit-DB
Atlassian Jira Server Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)
The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before
23RIESGO
abrir ↗Exploit-DB
Seeddms 5.1.10 - Remote Command Execution (RCE) (Authenticated)
SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a differe
28RIESGO
abrir ↗Exploit-DB
Adobe ColdFusion 8 - Remote Command Execution (RCE)
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable fil
60RIESGO
abrir ↗Exploit-DB
VMware vCenter Server 7.0 - Remote Code Execution (RCE) (Unauthenticated)
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RIESGO
abrir ↗Exploit-DB
TP-Link TL-WR841N - Command Injection
A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216
35RIESGO
abrir ↗Exploit-DB
WordPress Plugin WP Google Maps 8.1.11 - Stored Cross-Site Scripting (XSS)
WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)
23RIESGO
abrir ↗Exploit-DB
Solaris SunSSH 11.0 x86 - libpam Remote Root (3)
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Websvn 2.6.0 - Remote Code Execution (Unauthenticated)
WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search paramet
60RIESGO
abrir ↗Exploit-DB
OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated)
An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can
50RIESGO
abrir ↗Exploit-DB
Node.JS - 'node-serialize' Remote Code Execution (3)
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu
35RIESGO
abrir ↗Exploit-DB
Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration
Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-messag
28RIESGO
abrir ↗Exploit-DB
OpenEMR 5.0.1.3 - Authentication Bypass
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Polkit 0.105-26 0.117-2 - Local Privilege Escalation
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile
91RIESGO
abrir ↗Exploit-DB
OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated)
Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote
28RIESGO
abrir ↗Exploit-DB
Accela Civic Platform 21.1 - 'contactSeqNumber' Insecure Direct Object References (IDOR)
portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows remote attackers to obtain sensiti
23RIESGO
abrir ↗Exploit-DB
Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)
Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are
38RIESGO
abrir ↗Exploit-DB
WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF
Database Backups <= 1.2.2.6 - CSRF to Backup Download
23RIESGO
abrir ↗Exploit-DB
Microsoft SharePoint Server 16.0.10372.20060 - 'GetXmlDataFromDataSource' Server-Side Request Forgery (SSRF)
Microsoft SharePoint Server Spoofing Vulnerability
41RIESGO
abrir ↗Exploit-DB
Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS)
In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The
38RIESGO
abrir ↗Exploit-DB
OpenEMR 5.0.0 - Remote Code Execution (Authenticated)
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
28RIESGO
abrir ↗Exploit-DB
Cerberus FTP Web Service 11 - 'svg' Stored Cross-Site Scripting (XSS)
The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document.
23RIESGO
abrir ↗Exploit-DB
Intelbras Router RF 301K - 'DNS Hijacking' Cross-Site Request Forgery (CSRF)
Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mecha
23RIESGO
abrir ↗Exploit-DB
WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo
85RIESGO
abrir ↗Exploit-DB
IcoFX 2.6 - '.ico' Buffer Overflow SEH + DEP Bypass using JOP
Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCoun
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Rocket.Chat 3.12.1 - NoSQL Injection (Unauthenticated)
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.