Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados

40.452CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

18.044 exploits

GitHub PoC★ 1

Nicoslo/Windows-exploitation-Rejetto-HTTP-File-Server-HFS-2.3.x-CVE-2014-6287

CVE-2014-6287CRITICALbajo ataque20 feb 2021

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RIESGO

abrir ↗

GitHub PoC★ 1

Nicoslo/Windows-exploitation-Apache-Tomcat-8.5.19-CVE-2019-0232-

CVE-2019-0232—20 feb 2021

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RIESGO

abrir ↗

GitHub PoC

roninAPT/CVE-2018-0802

CVE-2018-0802HIGHbajo ataqueransomware20 feb 2021

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow

93RIESGO

abrir ↗

GitHub PoC

Full exploit code for CVE-2019-25024 an unauthenticated command injection flaw in OpenRepeater.

CVE-2019-25024—19 feb 2021

OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_sy

28RIESGO

abrir ↗

GitHub PoC

Eternit7/CVE-2019-1458

CVE-2019-1458HIGHbajo ataqueransomware19 feb 2021

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

100RIESGO

abrir ↗

GitHub PoC★ 166

Laravel <= v8.4.2 debug mode: Remote code execution (CVE-2021-3129)

CVE-2021-3129CRITICALbajo ataqueransomware18 feb 2021

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RIESGO

abrir ↗

GitHub PoC★ 1

Nicoslo/Windows-exploitation-BadBlue-2.7-CVE-2007-6377

CVE-2007-6377—18 feb 2021

Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attacker

50RIESGO

abrir ↗

GitHub PoC★ 1

PoC for CVE-2015-1769

CVE-2015-1769MEDIUMbajo ataque17 feb 2021

Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,

63RIESGO

abrir ↗

GitHub PoC★ 2

FunPhishing/Laravel-8.4.2-rce-CVE-2021-3129

CVE-2021-3129CRITICALbajo ataqueransomware14 feb 2021

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RIESGO

abrir ↗

GitHub PoC★ 3

OpenSSL Heartbleed Bug CVE-2014-0160 Toolkit. Built with ❤ by Christopher Ngo.

CVE-2014-0160HIGHbajo ataque14 feb 2021

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

abrir ↗

GitHub PoC★ 4

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker.

CVE-2021-21014CRITICAL13 feb 2021

Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution

48RIESGO

abrir ↗

GitHub PoC★ 11

OpenSMTPD 6.4.0 - 6.6.1 Remote Code Execution PoC exploit

CVE-2020-7247CRITICALbajo ataque13 feb 2021

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RIESGO

abrir ↗

GitHub PoC★ 8

Test for CVE-2000-0649, and return an IP address if vulnerable

CVE-2000-0649—11 feb 2021

IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page w

60RIESGO

abrir ↗

GitHub PoC★ 40

synacktiv/CVE-2021-1782

CVE-2021-1782HIGHbajo ataque10 feb 2021

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-00

71RIESGO

abrir ↗

GitHub PoC★ 16

sudo heap overflow to LPE, in Go

CVE-2021-3156HIGHbajo ataque09 feb 2021

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

abrir ↗

GitHub PoC★ 204

CVE-2021-3156非交互式执行命令

CVE-2021-3156HIGHbajo ataque09 feb 2021

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

abrir ↗

GitHub PoC

보안취약점 확인

CVE-2021-3156HIGHbajo ataque09 feb 2021

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

abrir ↗

GitHub PoC

Fixed version of the Python script to exploit CVE-2018-19571 and CVE-2018-19585 (GitLab 11.4.7 - Authenticated Remote Code Execution) that is available at https://www.exploit-db.com/exploits/49263 (Python 3.9).

CVE-2018-19571—08 feb 2021

GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an

35RIESGO

abrir ↗

GitHub PoC★ 51

CVE-2021-3156: Sudo heap overflow exploit for Debian 10

CVE-2021-3156HIGHbajo ataque08 feb 2021

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

abrir ↗

GitHub PoC★ 11

CVE-2020-7384

CVE-2020-7384HIGH07 feb 2021

Client-Side Command Injection in Rapid7 Metasploit

68RIESGO

abrir ↗

GitHub PoC

Apple Safari Remote Code Execution

CVE-2020-27930HIGHbajo ataque07 feb 2021

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, wat

76RIESGO

abrir ↗

GitHub PoC★ 2

Grayhaxor/CVE-2021-21148

CVE-2021-21148HIGHbajo ataque07 feb 2021

Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap

76RIESGO

abrir ↗

GitHub PoC★ 7

1N53C/CVE-2021-3156-PoC

CVE-2021-3156HIGHbajo ataque06 feb 2021

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

abrir ↗

GitHub PoC★ 4

Temproot for Pixel 2 and Pixel 2 XL via CVE-2019-2215

CVE-2019-2215HIGHbajo ataque05 feb 2021

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RIESGO

abrir ↗

GitHub PoC

DXY0411/CVE-2019-16113

CVE-2019-16113—05 feb 2021

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j

60RIESGO

abrir ↗

GitHub PoC

46o60/CVE-2019-3396_Confluence

CVE-2019-3396CRITICALbajo ataqueransomware05 feb 2021

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers

100RIESGO

abrir ↗

GitHub PoC

Custom version of sudo 1.8.3p1 with CVE-2021-3156 patches applied

CVE-2021-3156HIGHbajo ataque05 feb 2021

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RIESGO

abrir ↗

GitHub PoC★ 2

Poc for CVE-2020-14181

CVE-2020-14181—05 feb 2021

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Infor

60RIESGO

abrir ↗

GitHub PoC★ 2

simple bash script of F5 BIG-IP TMUI Vulnerability CVE-2020-5902 checker

CVE-2020-5902CRITICALbajo ataqueransomware04 feb 2021

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RIESGO

abrir ↗

GitHub PoC★ 67

CVE-2020-3992 & CVE-2019-5544

CVE-2019-5544CRITICALbajo ataqueransomware04 feb 2021

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.