Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
79.057exploits catalogados
36.288CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.460Referência 22.910GitHub PoC 14.997VulnCheck XDB 8843Nuclei 4358Metasploit 3489✓ solo verificadosrecientespopularesriesgo
24.458 exploits
Exploit-DB
TP-Link TL-WR1043ND 2 - Authentication Bypass
An issue was discovered on TP-Link TL-WR1043ND V2 devices. An attacker can send a cookie in an HTTP authentication packe
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Kernel - Out-of-Bounds Read in nt!MiRelocateImage While Parsing Malformed PE File
A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Servi
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
XNU - Remote Double-Free via Data Race in IPComp Input Path
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15, tvOS
23RIESGO
abrir ↗Exploit-DB
Subrion 4.2.1 - 'Email' Persistant Cross-Site Scripting
Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" i
23RIESGO
abrir ↗Exploit-DB
CheckPoint Endpoint Security Client/ZoneAlarm 15.4.062.17802 - Privilege Escalation
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
23RIESGO
abrir ↗Exploit-DB
IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload
IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root pr
53RIESGO
abrir ↗Exploit-DB
vBulletin 5.0 < 5.5.4 - 'updateAvatar' Authenticated Remote Code Execution
vBulletin through 5.5.4 mishandles custom avatars.
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Android - Binder Driver Use-After-Free
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
98RIESGO
abrir ↗Exploit-DB
AnchorCMS < 0.12.3a - Information Disclosure
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contain
60RIESGO
abrir ↗Exploit-DB
mintinstall 7.9.9 - Code Execution
mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by a
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RIESGO
abrir ↗Exploit-DB
DotNetNuke < 9.4.0 - Cross-Site Scripting
Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the mali
23RIESGO
abrir ↗Exploit-DB
GoAhead 2.5.0 - Host Header Injection
An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) cre
23RIESGO
abrir ↗Exploit-DB
Cisco Small Business 220 Series - Multiple Vulnerabilities
Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability
46RIESGO
abrir ↗Exploit-DB
phpIPAM 1.4 - SQL Injection
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is us
28RIESGO
abrir ↗Exploit-DB
WordPress Plugin ARforms 3.7.1 - Arbitrary File Deletion
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an
23RIESGO
abrir ↗Exploit-DB
Cisco Small Business 220 Series - Multiple Vulnerabilities
Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities
53RIESGO
abrir ↗Exploit-DB
Cisco Small Business 220 Series - Multiple Vulnerabilities
Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability
53RIESGO
abrir ↗Exploit-DB
vBulletin 5.x - Remote Command Execution (Metasploit)
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RIESGO
abrir ↗Exploit-DB
Microsoft SharePoint 2013 SP1 - 'DestinationFolder' Persistant Cross-Site Scripting
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a speciall
23RIESGO
abrir ↗Exploit-DB
NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be inje
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ABRT - sosreport Privilege Escalation (Metasploit)
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain perm
38RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit)
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RIESGO
abrir ↗Exploit-DB
Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection
pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_ph
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
iMessage - Decoding NSSharedKeyDictionary Can Read Object Out of Bounds
An out-of-bounds read was addressed with improved input validation.
28RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.