Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

82.877 exploits

VulnCheck XDB

initial-access

CVE-2021-32849HIGH25 abr 2022

Arbitrary command execution in Gerapy

41RIESGO

abrir ↗

GitHub PoC

My research about CVE-2021-4034

CVE-2021-4034HIGHbajo ataqueransomware24 abr 2022

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

abrir ↗

VulnCheck XDB

local

CVE-2021-4034HIGHbajo ataqueransomware24 abr 2022

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-29464CRITICALbajo ataqueransomware24 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC

h3x0v3rl0rd/CVE-2014-0160_Heartbleed

CVE-2014-0160HIGHbajo ataque24 abr 2022

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RIESGO

abrir ↗

GitHub PoC★ 28

😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

CVE-2022-29464CRITICALbajo ataqueransomware24 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC

h3x0v3rl0rd/CVE-2022-29464

CVE-2022-29464CRITICALbajo ataqueransomware24 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC★ 1

Proof of concept exploit for CVE-2021-42697: Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

CVE-2021-42697—24 abr 2022

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, whic

35RIESGO

abrir ↗

GitHub PoC★ 6

Proof of concept exploit for CVE-2022-29548: A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.

CVE-2022-29548MEDIUM24 abr 2022

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0,

60RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALbajo ataque23 abr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

abrir ↗

GitHub PoC

CVE-2022-26809-RCE

CVE-2022-26809CRITICAL23 abr 2022

Remote Procedure Call Runtime Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC★ 5

mariomamo/CVE-2022-22965

CVE-2022-22965CRITICALbajo ataque23 abr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-29464CRITICALbajo ataqueransomware22 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

VulnCheck XDB

client-side

CVE-2017-0199HIGHbajo ataqueransomware22 abr 2022

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window

100RIESGO

abrir ↗

GitHub PoC

This repository contains a PoC for remote code execution CVE-2022-26809

CVE-2022-26809CRITICAL22 abr 2022

Remote Procedure Call Runtime Remote Code Execution Vulnerability

70RIESGO

abrir ↗

GitHub PoC

A python script/generator, for generating and exploiting Microsoft vulnerability

CVE-2017-0199HIGHbajo ataqueransomware22 abr 2022

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window

100RIESGO

abrir ↗

GitHub PoC★ 1

0xAgun/CVE-2022-29464

CVE-2022-29464CRITICALbajo ataqueransomware22 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC★ 5

cve-2022-29464 批量脚本

CVE-2022-29464CRITICALbajo ataqueransomware22 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC★ 5

WSO2 RCE (CVE-2022-29464)

CVE-2022-29464CRITICALbajo ataqueransomware22 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC★ 3

Repository containing nse script for vulnerability CVE-2022-29464 known as WSO2 RCE.

CVE-2022-29464CRITICALbajo ataqueransomware22 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC★ 2

tufanturhan/wso2-rce-cve-2022-29464

CVE-2022-29464CRITICALbajo ataqueransomware21 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC★ 2

Pre-auth RCE bug CVE-2022-29464

CVE-2022-29464CRITICALbajo ataqueransomware21 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2016-10924—21 abr 2022

The ebook-download plugin before 1.2 for WordPress has directory traversal.

43RIESGO

abrir ↗

GitHub PoC★ 1

c4mx/CVE-2022-22965_PoC

CVE-2022-22965CRITICALbajo ataque21 abr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RIESGO

abrir ↗

GitHub PoC

CVE-2021-4034 PoC

CVE-2021-4034HIGHbajo ataqueransomware20 abr 2022

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RIESGO

abrir ↗

VulnCheck XDB

client-side

CVE-2017-0199HIGHbajo ataqueransomware20 abr 2022

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2022-29464CRITICALbajo ataqueransomware20 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC★ 377

WSO2 RCE (CVE-2022-29464) exploit and writeup.

CVE-2022-29464CRITICALbajo ataqueransomware20 abr 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RIESGO

abrir ↗

GitHub PoC

MS CVE 2019-0708 Python Exploit

CVE-2019-0708CRITICALbajo ataqueransomware20 abr 2022

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2017-9841CRITICALbajo ataque20 abr 2022

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.