Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
79.057exploits catalogados
36.288CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.910GitHub PoC 14.997VulnCheck XDB 8843Nuclei 4358Metasploit 3489✓ solo verificadosrecientespopularesriesgo
24.458 exploits
Exploit-DB
WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
iOS/macOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand()
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3
76RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)
D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Windscribe - WindscribeService Named Pipe Privilege Escalation (Metasploit)
The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe s
38RIESGO
abrir ↗Exploit-DB
EyesOfNetwork 5.3 - Remote Code Execution
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthe
60RIESGO
abrir ↗Exploit-DB
EyesOfNetwork 5.3 - Remote Code Execution
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability
98RIESGO
abrir ↗Exploit-DB
EyesOfNetwork 5.3 - Remote Code Execution
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoD
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco Data Center Network Manager 11.2.1 - 'LanFabricImpl' Command Injection
Cisco Data Center Network Manager Command Injection Vulnerabilities
53RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco Data Center Network Manager 11.2.1 - 'getVmHostData' SQL Injection
Cisco Data Center Network Manager SQL Injection Vulnerabilities
53RIESGO
abrir ↗Exploit-DB
Sudo 1.8.25p - 'pwfeedback' Buffer Overflow
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco Data Center Network Manager 11.2.1 - 'getVmHostData' SQL Injection
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
70RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco Data Center Network Manager 11.2 - Remote Code Execution
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
85RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco Data Center Network Manager 11.2.1 - 'LanFabricImpl' Command Injection
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
60RIESGO
abrir ↗Exploit-DB
Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate se
41RIESGO
abrir ↗Exploit-DB
xglance-bin 11.00 - Privilege Escalation
Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via u
38RIESGO
abrir ↗Exploit-DB
Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)
An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated se
23RIESGO
abrir ↗Exploit-DB
Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation
A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via
33RIESGO
abrir ↗Exploit-DB
Sudo 1.8.25p - 'pwfeedback' Buffer Overflow (PoC)
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the
28RIESGO
abrir ↗Exploit-DB
IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
43RIESGO
abrir ↗Exploit-DB
School ERP System 1.0 - Cross Site Request Forgery (Add Admin)
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrati
23RIESGO
abrir ↗Exploit-DB
BearFTP 0.1.0 - 'PASV' Denial of Service
IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to th
28RIESGO
abrir ↗Exploit-DB
Jira 8.3.4 - Information Disclosure (Username Enumeration)
The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate username
60RIESGO
abrir ↗Exploit-DB
Cacti 1.2.8 - Authenticated Remote Code Execution
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a
60RIESGO
abrir ↗Exploit-DB
Schneider Electric U.Motion Builder 1.3.4 - Authenticated Command Injection
The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Ele
35RIESGO
abrir ↗Exploit-DB
Cacti 1.2.8 - Unauthenticated Remote Code Execution
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a
60RIESGO
abrir ↗Exploit-DB
School ERP System 1.0 - Cross Site Request Forgery (Add Admin)
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
OpenSMTPD 6.6.1 - Remote Code Execution
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
rConfig 3.9.3 - Authenticated Remote Code Execution
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a
60RIESGO
abrir ↗Exploit-DB
Microsoft Windows 10 - Theme API 'ThemePack' File Parsing
A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows T
35RIESGO
abrir ↗Exploit-DB
Satellian 1.12 - Remote Code Execution
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to th
60RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.