Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.655exploits catalogados
39.248CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.347Exploit-DB 24.485GitHub PoC 16.178VulnCheck XDB 9644Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB
Laravel Administrator 4 - Unrestricted File Upload (Authenticated)
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution)
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Razer Chroma SDK Server 3.16.02 - Race Condition Remote File Execution
Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a ra
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ZeroShell 3.9.0 - 'cgi-bin/kerbynet' Remote Root Command Injection (Metasploit)
Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web ap
60RIESGO
abrir ↗Exploit-DB
Apache OpenMeetings 5.0.0 - 'hostname' Denial of Service
Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
35RIESGO
abrir ↗Exploit-DB
LifeRay 7.2.1 GA2 - Stored XSS
In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyA
23RIESGO
abrir ↗Exploit-DB
TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP
76RIESGO
abrir ↗Exploit-DB
Fortinet FortiOS 6.0.4 - Unauthenticated SSL VPN User Password Modification
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and Forti
100RIESGO
abrir ↗Exploit-DB
xuucms 3 - 'keywords' SQL Injection
cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parame
23RIESGO
abrir ↗Exploit-DB
PESCMS TEAM 2.3.2 - Multiple Reflected XSS
PESCMS Team 2.3.2 has multiple reflected XSS via the id parameter:?g=Team&m=Task&a=my&status=3&id=,?g=Team&m=Task&a=my&s
23RIESGO
abrir ↗Exploit-DB
Gemtek WVRTM-127ACN 01.01.02.141 - Authenticated Arbitrary Command Injection
An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic n
28RIESGO
abrir ↗Exploit-DB
ZeroLogon - Netlogon Elevation of Privilege
Netlogon Elevation of Privilege Vulnerability
100RIESGO
abrir ↗Exploit-DB
BigBlueButton 2.2.25 - Arbitrary File Disclosure and Server-Side Request Forgery
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploade
28RIESGO
abrir ↗Exploit-DB
Microsoft Internet Explorer 11 - Use-After-Free
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet
93RIESGO
abrir ↗Exploit-DB
Apache Struts 2.5.20 - Double OGNL evaluation
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea
60RIESGO
abrir ↗Exploit-DB
Aerospike Database 5.1.0.3 - OS Command Execution
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs)
60RIESGO
abrir ↗Exploit-DB
OpenCart Theme Journal 3.1.0 - Sensitive Data Exposure
The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.
23RIESGO
abrir ↗Exploit-DB
Touchbase.io 1.10 - Stored Cross Site Scripting
HTML Injection in touchbase.ai
41RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Apache Tomcat - AJP 'Ghostcat' File Read/Inclusion (Metasploit)
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RIESGO
abrir ↗Exploit-DB
October CMS Build 465 - Arbitrary File Read Exploit (Authenticated)
Local File read vulnerability in OctoberCMS
33RIESGO
abrir ↗Exploit-DB
ShoreTel Conferencing 19.46.1802.0 - Reflected Cross-Site Scripting
The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a r
43RIESGO
abrir ↗Exploit-DB
Joplin 1.2.6 - 'link' Cross Site Scripting
Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.
23RIESGO
abrir ↗Exploit-DB
SuiteCRM 7.11.15 - 'last_name' Remote Code Execution (Authenticated)
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain
50RIESGO
abrir ↗Exploit-DB
Genexis Platinum-4410 P4410-V2-1.28 - Broken Access Control and CSRF
A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally
23RIESGO
abrir ↗Exploit-DB
TP-Link WDR4300 - Remote Code Execution (Authenticated)
Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated
35RIESGO
abrir ↗Exploit-DB
Amarok 2.8.0 - Denial-of-Service
A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will tri
23RIESGO
abrir ↗Exploit-DB
DedeCMS v.5.8 - _keyword_ Cross-Site Scripting
A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to
23RIESGO
abrir ↗Exploit-DB
Blueman < 2.1.4 - Local Privilege Escalation
Local privilege escalation Blueman
41RIESGO
abrir ↗Exploit-DB
Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins
100RIESGO
abrir ↗Exploit-DB
Nagios XI 5.7.3 - 'mibs.php' Remote Command Injection (Authenticated)
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admi
60RIESGO
abrir ↗Exploit-DB
Sentrifugo 3.2 - File Upload Restriction Bypass (Authenticated)
Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arb
35RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.