Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

4478 exploits

Nucleimedium

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

CVE-2017-20194MEDIUM

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

28RIESGO

abrir ↗

Nucleimedium

FortiOS 5.4.0 to 5.6.0 - Cross-Site Scripting

CVE-2017-3131—

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to exec

38RIESGO

abrir ↗

Nucleimedium

Fortinet FortiOS < 5.6.0 - Cross-Site Scripting

CVE-2017-3132—

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthor

38RIESGO

abrir ↗

Nucleimedium

Fortinet FortiOS < 5.6.0 - Cross-Site Scripting

CVE-2017-3133—

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthor

43RIESGO

abrir ↗

Nucleihigh

Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution

CVE-2017-3506HIGHbajo ataque

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte

100RIESGO

abrir ↗

Nucleimedium

Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect

CVE-2017-3528—

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li

43RIESGO

abrir ↗

Nucleimedium

McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting

CVE-2017-4011—

Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x a

18RIESGO

abrir ↗

Nucleihigh

NETGEAR Routers - Authentication Bypass

CVE-2017-5521HIGHbajo ataque

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R

100RIESGO

abrir ↗

Nucleihigh

PhpMyAdmin <4.8.2 - Local File Inclusion

CVE-2018-12613—

An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute

60RIESGO

abrir ↗

Nucleicritical

CirCarLife Scada <4.3 - System Log Exposure

CVE-2018-12634—

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/lo

50RIESGO

abrir ↗

Nucleimedium

SV3C HD Camera L Series - Open Redirect

CVE-2018-12675—

The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) does not perform origin

18RIESGO

abrir ↗

Nucleimedium

Spring MVC Framework - Local File Inclusion

CVE-2018-1271—

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow app

30RIESGO

abrir ↗

Nucleicritical

Spring Data Commons - Remote Code Execution

CVE-2018-1273CRITICALbajo ataqueransomware

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property

100RIESGO

abrir ↗

Nucleihigh

Webgrind <= 1.5 - Local File Inclusion

CVE-2018-12909—

Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the we

23RIESGO

abrir ↗

Nucleimedium

Zoho manageengine - Cross-Site Scripting

CVE-2018-12998—

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network

40RIESGO

abrir ↗

Nucleimedium

TOTOLINK A3002RU 1.0.8 - Information Disclosure

CVE-2018-13317—

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password

18RIESGO

abrir ↗

Nucleihigh

Apache Tika < 1.1.8 - Header Command Injection

CVE-2018-1335—

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to

60RIESGO

abrir ↗

Nucleicritical

Fortinet FortiOS - Credentials Disclosure

CVE-2018-13379CRITICALbajo ataqueransomware

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.

100RIESGO

abrir ↗

Nucleimedium

Fortinet FortiOS - Cross-Site Scripting

CVE-2018-13380MEDIUM

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and

40RIESGO

abrir ↗

Nucleimedium

Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion

CVE-2018-13980—

The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclos

38RIESGO

abrir ↗

Nucleimedium

Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting

CVE-2018-14013—

Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.

18RIESGO

abrir ↗

Nucleicritical

VelotiSmart Wifi - Directory Traversal

CVE-2018-14064—

The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../..

50RIESGO

abrir ↗

Nucleimedium

Orange Forum 1.4.0 - Open Redirect

CVE-2018-14474—

views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.

18RIESGO

abrir ↗

Nucleimedium

Django - Open Redirect

CVE-2018-14574—

django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

23RIESGO

abrir ↗

Nucleicritical

Responsive filemanager 9.13.1 Server-Side Request Forgery

CVE-2018-14728—

upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.

60RIESGO

abrir ↗

Nucleihigh

cgit < 1.2.1 - Directory Traversal

CVE-2018-14912—

cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned

60RIESGO

abrir ↗

Nucleicritical

Loytec LGATE-902 <6.4.2 - Local File Inclusion

CVE-2018-14916—

LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.

23RIESGO

abrir ↗

Nucleihigh

LOYTEC LGATE-902 6.3.2 - Local File Inclusion

CVE-2018-14918—

LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.

23RIESGO

abrir ↗

Nucleimedium

Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect

CVE-2018-14931—

An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. An open redirect exis

18RIESGO

abrir ↗

Nucleicritical

NUUO NVRmini - Remote Command Execution

CVE-2018-14933CRITICALbajo ataque

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir par

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.