Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

79.107exploits catalogados

36.322CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8846Nuclei 4361Metasploit 3490✓ solo verificadosrecientes populares riesgo

4361 exploits

Nucleimedium

Jira <8.4.0 - Information Disclosure

CVE-2019-8449—

The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate username

60RIESGO

abrir ↗

Nucleimedium

Jira <8.4.0 - Server-Side Request Forgery

CVE-2019-8451—

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the con

60RIESGO

abrir ↗

Nucleihigh

Totaljs <3.2.3 - Local File Inclusion

CVE-2019-8903—

index.js in Total.js Platform before 3.2.3 allows path traversal.

40RIESGO

abrir ↗

Nucleimedium

HotelDruid 2.3.0 - Cross-Site Scripting

CVE-2019-8937—

HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel

43RIESGO

abrir ↗

Nucleimedium

WordPress Core 5.0.0 - Crop-image Shell Upload

CVE-2019-8943—

WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can

60RIESGO

abrir ↗

Nucleicritical

Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery

CVE-2019-8982—

com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&

43RIESGO

abrir ↗

Nucleihigh

ZZZCMS 1.6.1 - Remote Code Execution

CVE-2019-9041—

An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filter

50RIESGO

abrir ↗

Nucleihigh

ThinkPHP < 3.2.4 - Remote Code Execution

CVE-2019-9082HIGHbajo ataque

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/

100RIESGO

abrir ↗

Nucleicritical

elFinder <= 2.1.47 - Command Injection

CVE-2019-9194—

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

60RIESGO

abrir ↗

Nucleicritical

WordPress GraceMedia Media Player 1.0 - Local File Inclusion

CVE-2019-9618—

The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.

50RIESGO

abrir ↗

Nucleihigh

Zimbra Collaboration Suite - SSRF

CVE-2019-9621HIGHbajo ataque

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x b

100RIESGO

abrir ↗

Nucleihigh

ESAFENET CDG - Arbitrary File Download

CVE-2019-9632—

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because t

30RIESGO

abrir ↗

Nucleicritical

Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection

CVE-2019-9670CRITICALbajo ataque

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX

100RIESGO

abrir ↗

Nucleihigh

Homematic CCU3 - Local File Inclusion

CVE-2019-9726—

Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read

23RIESGO

abrir ↗

Nucleicritical

JFrog Artifactory 6.7.3 - Admin Login Bypass

CVE-2019-9733—

An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password o

30RIESGO

abrir ↗

Nucleihigh

LabKey Server 19.1.0 - XML External Entity (XXE)

CVE-2019-9757—

An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-

30RIESGO

abrir ↗

Nucleicritical

PHPSHE 1.7 - SQL Injection

CVE-2019-9762—

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnera

18RIESGO

abrir ↗

Nucleicritical

Sitecore Experience Platform - Deserialization of Untrusted Data

CVE-2019-9874CRITICALbajo ataque

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an

95RIESGO

abrir ↗

Nucleicritical

WPGraphQL 0.2.3 - User Creation

CVE-2019-9879—

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever

50RIESGO

abrir ↗

Nucleicritical

WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure

CVE-2019-9880—

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible,

50RIESGO

abrir ↗

Nucleimedium

WordPress GTranslate <2.8.52 - Cross-Site Scripting

CVE-2020-11930—

The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflan

18RIESGO

abrir ↗

Nucleicritical

Apache Unomi - Remote Code Execution

CVE-2020-11975—

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the J

43RIESGO

abrir ↗

Nucleihigh

Apache Airflow <=1.10.10 - Remote Code Execution

CVE-2020-11978HIGHbajo ataque

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was disco

100RIESGO

abrir ↗

Nucleicritical

Apache HTTP Server - Remote Code Execution

CVE-2020-11984—

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

60RIESGO

abrir ↗

Nucleihigh

Apache Cocoon 2.1.12 - XML Injection

CVE-2020-11991—

When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system e

40RIESGO

abrir ↗

Nucleimedium

WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting

CVE-2020-12054—

The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also a

18RIESGO

abrir ↗

Nucleihigh

Zoho ManageEngine OpManger - Arbitrary File Read

CVE-2020-12116—

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attack

40RIESGO

abrir ↗

Nucleicritical

WAVLINK WN530H4 live_api.cgi - Command Injection

CVE-2020-12124—

A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.1

60RIESGO

abrir ↗

Nucleihigh

WAVLINK WN530H4 M30H4.V5030.190403 - Information Disclosure

CVE-2020-12127—

An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030

18RIESGO

abrir ↗

Nucleimedium

rConfig 3.9.4 - Cross-Site Scripting

CVE-2020-12256—

rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can

40RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.