Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

24.485 exploits

Exploit-DB

CheckPoint Endpoint Security Client/ZoneAlarm 15.4.062.17802 - Privilege Escalation

CVE-2019-8452—localwindows07 oct 2019

A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien

23RIESGO

Exploit-DB

vBulletin 5.0 < 5.5.4 - 'updateAvatar' Authenticated Remote Code Execution

CVE-2019-17132—webappsphp07 oct 2019

vBulletin through 5.5.4 mishandles custom avatars.

28RIESGO

Exploit-DB

IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload

CVE-2019-4013CRITICALwebappsjava07 oct 2019

IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root pr

53RIESGO

Exploit-DB

Subrion 4.2.1 - 'Email' Persistant Cross-Site Scripting

CVE-2019-17225—webappsphp07 oct 2019

Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" i

23RIESGO

Exploit-DB✓ VexDay Proof

Android - Binder Driver Use-After-Free

CVE-2019-2215HIGHbajo ataquelocalandroid04 oct 2019

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

100RIESGO

Exploit-DB

AnchorCMS < 0.12.3a - Information Disclosure

CVE-2018-7251—webappsmultiple03 oct 2019

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contain

60RIESGO

Exploit-DB

mintinstall 7.9.9 - Code Execution

CVE-2019-17080—webappslinux03 oct 2019

mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by a

23RIESGO

Exploit-DB✓ VexDay Proof

DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)

CVE-2017-0145HIGHbajo ataqueransomwareremotewindows02 oct 2019

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

Exploit-DB✓ VexDay Proof

DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)

CVE-2017-0144HIGHbajo ataqueransomwareremotewindows02 oct 2019

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

Exploit-DB✓ VexDay Proof

DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)

CVE-2017-0147HIGHbajo ataqueransomwareremotewindows02 oct 2019

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

Exploit-DB✓ VexDay Proof

DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)

CVE-2017-0146HIGHbajo ataqueransomwareremotewindows02 oct 2019

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

Exploit-DB✓ VexDay Proof

DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)

CVE-2017-0148HIGHbajo ataqueransomwareremotewindows02 oct 2019

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

Exploit-DB✓ VexDay Proof

DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)

CVE-2017-0143HIGHbajo ataqueransomwareremotewindows02 oct 2019

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

Exploit-DB

DotNetNuke < 9.4.0 - Cross-Site Scripting

CVE-2019-12562—webappsmultiple01 oct 2019

Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the mali

23RIESGO

Exploit-DB

phpIPAM 1.4 - SQL Injection

CVE-2019-16692—webappsphp30 sep 2019

phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is us

28RIESGO

Exploit-DB

Cisco Small Business 220 Series - Multiple Vulnerabilities

CVE-2019-1914HIGHremotehardware30 sep 2019

Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability

46RIESGO

Exploit-DB

Cisco Small Business 220 Series - Multiple Vulnerabilities

CVE-2019-1912CRITICALremotehardware30 sep 2019

Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability

53RIESGO

Exploit-DB

GoAhead 2.5.0 - Host Header Injection

CVE-2019-16645—remotemultiple30 sep 2019

An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) cre

23RIESGO

Exploit-DB

vBulletin 5.x - Remote Command Execution (Metasploit)

CVE-2019-16759CRITICALbajo ataquewebappsphp30 sep 2019

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge

100RIESGO

Exploit-DB

WordPress Plugin ARforms 3.7.1 - Arbitrary File Deletion

CVE-2019-16902—webappsphp30 sep 2019

In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an

23RIESGO

Exploit-DB

Cisco Small Business 220 Series - Multiple Vulnerabilities

CVE-2019-1913CRITICALremotehardware30 sep 2019

Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities

53RIESGO

Exploit-DB

Microsoft SharePoint 2013 SP1 - 'DestinationFolder' Persistant Cross-Site Scripting

CVE-2019-1262—webappsaspx25 sep 2019

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a speciall

23RIESGO

Exploit-DB

NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution

CVE-2019-5485—webappsjson25 sep 2019

NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be inje

35RIESGO

Exploit-DB✓ VexDay Proof

ABRT - sosreport Privilege Escalation (Metasploit)

CVE-2015-5287HIGHbajo ataquelocallinux25 sep 2019

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain perm

86RIESGO

Exploit-DB

Pfsense 2.3.4 / 2.4.4-p3 - Remote Code Injection

CVE-2019-16701—webappsphp24 sep 2019

pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_ph

28RIESGO

Exploit-DB✓ VexDay Proof

Microsoft Windows - BlueKeep RDP Remote Windows Kernel Use After Free (Metasploit)

CVE-2019-0708CRITICALbajo ataqueransomwareremotewindows24 sep 2019

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau

100RIESGO

Exploit-DB✓ VexDay Proof

iMessage - Decoding NSSharedKeyDictionary Can Read Object Out of Bounds

CVE-2019-8641—dosios24 sep 2019

An out-of-bounds read was addressed with improved input validation.

28RIESGO

Exploit-DB

vBulletin 5.0 < 5.5.4 - 'widget_php ' Unauthenticated Remote Code Execution

CVE-2019-16759CRITICALbajo ataquewebappsphp23 sep 2019

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge

100RIESGO

Exploit-DB

Gila CMS < 1.11.1 - Local File Inclusion

CVE-2019-16679—webappsmultiple23 sep 2019

Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.

23RIESGO

Exploit-DB

iOS < 12.4.1 - 'Jailbreak' Local Privilege Escalation

CVE-2019-8605HIGHbajo ataquelocalios23 sep 2019

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.1

76RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.