Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.655exploits catalogados
39.248CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.347Exploit-DB 24.485GitHub PoC 16.178VulnCheck XDB 9644Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
3523 exploits
Metasploit600
Exim "perl_startup" Privilege Escalation
CVE-2016-1531—10 mar 2016
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
38RIESGO
abrir ↗
Metasploit600
Nagios XI Chained Remote Code Execution
CVE-2018-8733—06 mar 2016
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an
43RIESGO
abrir ↗
Metasploit600
Nagios XI Chained Remote Code Execution
CVE-2018-8736—06 mar 2016
A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RC
50RIESGO
abrir ↗
Metasploit600
Nagios XI Chained Remote Code Execution
CVE-2018-8735—06 mar 2016
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut
50RIESGO
abrir ↗
Metasploit0
Apache Jetspeed Arbitrary File Upload
CVE-2016-0709—06 mar 2016
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3
60RIESGO
abrir ↗
Metasploit0
Apache Jetspeed Arbitrary File Upload
CVE-2016-0710—06 mar 2016
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attacker
50RIESGO
abrir ↗
Metasploit600
Nagios XI Chained Remote Code Execution
CVE-2018-8734—06 mar 2016
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker
50RIESGO
abrir ↗
Metasploit600
ATutor 2.2.1 Directory Traversal / Remote Code Execution
CVE-2016-2555—01 mar 2016
SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbi
60RIESGO
abrir ↗
Metasploit600
ATutor 2.2.1 Directory Traversal / Remote Code Execution
CVE-2017-1000002—01 mar 2016
ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course
30RIESGO
abrir ↗
Metasploit600
ATutor 2.2.1 SQL Injection / Remote Code Execution
CVE-2016-2555—01 mar 2016
SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbi
60RIESGO
abrir ↗
Metasploit600
Ruby on Rails ActionPack Inline ERB Code Execution
CVE-2016-2098—01 mar 2016
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to e
60RIESGO
abrir ↗
Metasploit600
Netgear Devices Unauthenticated Remote Command Execution
CVE-2016-1555CRITICALbajo ataque25 feb 2016
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
100RIESGO
abrir ↗
Metasploit600
Jenkins XStream Groovy classpath Deserialization Vulnerability
CVE-2016-0792—24 feb 2016
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
60RIESGO
abrir ↗
Metasploit600
Primefaces Remote Code Execution Exploit
CVE-2017-1000486CRITICALbajo ataque15 feb 2016
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RIESGO
abrir ↗
Metasploit600
Xymon useradm Command Execution
CVE-2016-2056—14 feb 2016
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via
50RIESGO
abrir ↗
Metasploit600
Ubiquiti airOS Arbitrary File Upload
CVE-2015-9266CRITICAL13 feb 2016
Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload
85RIESGO
abrir ↗
Metasploit600
MS16-016 mrxdav.sys WebDav Local Privilege Escalation
CVE-2016-0051—09 feb 2016
The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window
43RIESGO
abrir ↗
Metasploit600
Advantech WebAccess Dashboard Viewer uploadImageCommon Arbitrary File Upload
CVE-2016-0854—05 feb 2016
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess
60RIESGO
abrir ↗
Metasploit500
D-Link DSL-2750B OS Command Injection
CVE-2016-20017CRITICALbajo ataque05 feb 2016
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as
100RIESGO
abrir ↗
Metasploit600
NETGEAR ProSafe Network Management System 300 Arbitrary File Upload
CVE-2023-38096CRITICAL04 feb 2016
NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability
65RIESGO
abrir ↗
Metasploit300
NETGEAR ProSafe Network Management System 300 Authenticated File Download
CVE-2016-1524—04 feb 2016
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote
60RIESGO
abrir ↗
Metasploit600
NETGEAR ProSafe Network Management System 300 Arbitrary File Upload
CVE-2016-1525—04 feb 2016
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RIESGO
abrir ↗
Metasploit600
NETGEAR ProSafe Network Management System 300 Arbitrary File Upload
CVE-2023-38098HIGH04 feb 2016
NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability
41RIESGO
abrir ↗
Metasploit600
lastore-daemon D-Bus Privilege Escalation
CVE-2016-15045HIGH02 feb 2016
Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation
36RIESGO
abrir ↗
Metasploit600
Oracle ATS Arbitrary File Upload
CVE-2016-0491—20 ene 2016
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
60RIESGO
abrir ↗
Metasploit600
Oracle ATS Arbitrary File Upload
CVE-2016-0492—20 ene 2016
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
60RIESGO
abrir ↗
Metasploit300
Windows Net-NTLMv2 Reflection DCOM/RPC
CVE-2016-3225—16 ene 2016
The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
50RIESGO
abrir ↗
Metasploit500
Windows Net-NTLMv2 Reflection DCOM/RPC (Juicy)
CVE-2016-3225—16 ene 2016
The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
50RIESGO
abrir ↗
Metasploit300
Fortinet SSH Backdoor Scanner
CVE-2016-1909—09 ene 2016
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
60RIESGO
abrir ↗
Metasploit600
TP-Link SC2020n Authenticated Telnet Injection
CVE-2013-2578—20 dic 2015
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models be
60RIESGO
abrir ↗
← anteriorpágina 49 / 118siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.