Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.655exploits catalogados
39.248CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.347Exploit-DB 24.485GitHub PoC 16.178VulnCheck XDB 9644Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB✓ VexDay Proof
ThinkPHP - Multiple PHP Injection RCEs (Metasploit)
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expect
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
VMware Fusion - USB Arbitrator Setuid Privilege Escalation (Metasploit)
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for
86RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware
48RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
PlaySMS - index.php Unauthenticated Template Injection Code Execution (Metasploit)
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer
61RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expect
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit)
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ThinkPHP - Multiple PHP Injection RCEs (Metasploit)
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Arch
68RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code e
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue ex
100RIESGO
abrir ↗Exploit-DB
Oracle WebLogic Server 12.2.1.4.0 - Remote Code Execution
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Su
100RIESGO
abrir ↗Exploit-DB
MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection
MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 a
23RIESGO
abrir ↗Exploit-DB
TVT NVMS 1000 - Directory Traversal
TVT NVMS-1000 devices allow GET /.. Directory Traversal
100RIESGO
abrir ↗Exploit-DB
Amcrest Dahua NVR Camera IP2M-841 - Denial of Service (PoC)
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacke
83RIESGO
abrir ↗Exploit-DB
WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.
83RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution (Metasploit)
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DLINK DWL-2600 - Authenticated Remote Command Injection (Metasploit)
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Config
60RIESGO
abrir ↗Exploit-DB
Grandstream UCM6200 Series CTI Interface - 'user_password' SQL Injection
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A rem
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
SharePoint Workflows - XOML Injection (Metasploit)
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.N
100RIESGO
abrir ↗Exploit-DB
Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RIESGO
abrir ↗Exploit-DB
Multiple DrayTek Products - Pre-authentication Remote Root Code Execution
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow
100RIESGO
abrir ↗Exploit-DB
TP-Link Archer C50 3 - Denial of Service (PoC)
TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a
28RIESGO
abrir ↗Exploit-DB
LeptonCMS 4.5.0 - Persistent Cross-Site Scripting
An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only secur
23RIESGO
abrir ↗Exploit-DB
UCM6202 1.0.18.13 - Remote Command Injection
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafte
100RIESGO
abrir ↗Exploit-DB
UliCMS 2020.1 - Persistent Cross-Site Scripting
UliCMS before 2020.2 has PageController stored XSS.
23RIESGO
abrir ↗Exploit-DB
WordPress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
VMware Fusion 11.5.2 - Privilege Escalation
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for
86RIESGO
abrir ↗Exploit-DB
Broadcom Wi-Fi Devices - 'KR00K Information Disclosure
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.