Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
79.041exploits catalogados
36.286CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.910GitHub PoC 14.995VulnCheck XDB 8829Nuclei 4358Metasploit 3489✓ solo verificadosrecientespopularesriesgo
24.458 exploits
Exploit-DB
UCM6202 1.0.18.13 - Remote Command Injection
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafte
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
VMware Fusion 11.5.2 - Privilege Escalation
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for
86RIESGO
abrir ↗Exploit-DB
Broadcom Wi-Fi Devices - 'KR00K Information Disclosure
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Rconfig 3.x - Chained Remote Code Execution (Metasploit)
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ManageEngine Desktop Central - Java Deserialization (Metasploit)
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted d
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Rconfig 3.x - Chained Remote Code Execution (Metasploit)
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RIESGO
abrir ↗Exploit-DB
Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Buffer Overflow (PoC)
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RIESGO
abrir ↗Exploit-DB
rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands vi
83RIESGO
abrir ↗Exploit-DB
rConfig 3.9 - 'searchColumn' SQL Injection
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php
60RIESGO
abrir ↗Exploit-DB
WordPress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or
23RIESGO
abrir ↗Exploit-DB
WordPress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php
23RIESGO
abrir ↗Exploit-DB
Joomla! 3.9.0 < 3.9.7 - CSV Injection
An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection.
28RIESGO
abrir ↗Exploit-DB
Horde Groupware Webmail Edition 5.2.22 - PHP File Inclusion
This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmai
33RIESGO
abrir ↗Exploit-DB
Horde Groupware Webmail Edition 5.2.22 - PHP File Inclusion
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webma
33RIESGO
abrir ↗Exploit-DB
Horde Groupware Webmail Edition 5.2.22 - PHAR Loading
This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmai
33RIESGO
abrir ↗Exploit-DB
Horde Groupware Webmail Edition 5.2.22 - PHAR Loading
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webma
33RIESGO
abrir ↗Exploit-DB
Horde Groupware Webmail Edition 5.2.22 - Remote Code Execution
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execu
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Nagios XI - Authenticated Remote Command Execution (Metasploit)
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Apache ActiveMQ 5.x-5.11.1 - Directory Traversal Shell Upload (Metasploit)
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
PHP-FPM - Underflow Remote Code Execution (Metasploit)
Underflow in PHP-FPM can lead to RCE
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Google Chrome 80 - JSCreate Side-effect Type Confusion (Metasploit)
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corru
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
OpenSMTPD - OOB Read Local Privilege Escalation (Metasploit)
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for mult
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Google Chrome 67_ 68 and 69 - Object.create Type Confusion (Metasploit)
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbit
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Google Chrome 72 and 73 - Array.map Out-of-Bounds Write (Metasploit)
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploi
90RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
EyesOfNetwork - AutoDiscovery Target Command Execution (Metasploit)
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability
98RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
EyesOfNetwork - AutoDiscovery Target Command Execution (Metasploit)
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoD
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
EyesOfNetwork - AutoDiscovery Target Command Execution (Metasploit)
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthe
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Exchange Control Panel - Viewstate Deserialization (Metasploit)
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
EyesOfNetwork - AutoDiscovery Target Command Execution (Metasploit)
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include
100RIESGO
abrir ↗Exploit-DB
Alfresco 5.2.4 - Persistent Cross-Site Scripting
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.