Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

4478 exploits

Nucleihigh

Ruby On Rails - Local File Inclusion

CVE-2018-3760—

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12

43RIESGO

abrir ↗

Nucleicritical

Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass

CVE-2018-3810—

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unau

60RIESGO

abrir ↗

Nucleimedium

Atlassian Jira Confluence - Cross-Site Scripting

CVE-2018-5230—

The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0

30RIESGO

abrir ↗

Nucleimedium

Grav CMS <1.3.0 - Cross-Site Scripting

CVE-2018-5233—

Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote

18RIESGO

abrir ↗

Nucleimedium

WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting

CVE-2018-5316—

The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.p

18RIESGO

abrir ↗

Nucleimedium

SugarCRM 3.5.1 - Cross-Site Scripting

CVE-2018-5715—

phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable).

38RIESGO

abrir ↗

Nucleihigh

Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion

CVE-2018-6008—

Arbitrary File Download exists in the Jtag Members Directory 5.3.7 component for Joomla! via the download_file parameter

50RIESGO

abrir ↗

Nucleihigh

Zeit Next.js < 4.2.3 - Local File Inclusion

CVE-2018-6184—

ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.

18RIESGO

abrir ↗

Nucleimedium

vBulletin - Open Redirect

CVE-2018-6200—

vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.

18RIESGO

abrir ↗

Nucleicritical

D-Link - Unauthenticated Remote Code Execution

CVE-2018-6530CRITICALbajo ataqueransomware

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_

95RIESGO

abrir ↗

Nucleicritical

Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection

CVE-2018-6605—

SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, get

50RIESGO

abrir ↗

Nucleimedium

Zimbra Collaboration Suite - Cross-site Scripting

CVE-2018-6882MEDIUMbajo ataqueransomware

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Sui

63RIESGO

abrir ↗

Nucleihigh

DedeCMS 5.7 - Path Disclosure

CVE-2018-6910—

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/in

23RIESGO

abrir ↗

Nucleicritical

VMware NSX SD-WAN Edge - Command Injection

CVE-2018-6961HIGHbajo ataque

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web U

100RIESGO

abrir ↗

Nucleicritical

D-Link Central WiFi Manager CWM(100) - Remote Code Execution

CVE-2019-13372—

/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote atta

40RIESGO

abrir ↗

Nucleimedium

MindPalette NateMail 3.0.15 - Cross-Site Scripting

CVE-2019-13392—

A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote

18RIESGO

abrir ↗

Nucleimedium

FlightPath - Local File Inclusion

CVE-2019-13396—

FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an in

50RIESGO

abrir ↗

Nucleicritical

Lansweeper Unauthenticated SQL Injection

CVE-2019-13462—

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.

23RIESGO

abrir ↗

Nucleihigh

Citrix StoreFront Server - XML External Entity

CVE-2019-13608HIGHbajo ataqueransomware

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE at

78RIESGO

abrir ↗

Nucleihigh

WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion

CVE-2019-14205—

A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attac

30RIESGO

abrir ↗

Nucleihigh

Nevma Adaptive Images - Arbitrary File Deletion

CVE-2019-14206—

An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote a

38RIESGO

abrir ↗

Nucleimedium

Alfresco Share - Open Redirect

CVE-2019-14223—

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share applicat

18RIESGO

abrir ↗

Nucleihigh

T24 Web Server - Local File Inclusion

CVE-2019-14251—

An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a docu

18RIESGO

abrir ↗

Nucleimedium

Aptana Jaxer 1.0.3.4547 - Local File inclusion

CVE-2019-14312—

Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This v

43RIESGO

abrir ↗

Nucleihigh

Pallets Werkzeug <0.15.5 - Local File Inclusion

CVE-2019-14322—

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

50RIESGO

abrir ↗

Nucleimedium

WordPress UserPro 4.9.32 - Cross-Site Scripting

CVE-2019-14470—

cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has X

60RIESGO

abrir ↗

Nucleihigh

OpenEMR <5.0.2 - Local File Inclusion

CVE-2019-14530—

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can

50RIESGO

abrir ↗

Nucleimedium

Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting

CVE-2019-14696—

Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.

43RIESGO

abrir ↗

Nucleimedium

osTicket < 1.12.1 - Cross-Site Scripting

CVE-2019-14750—

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It w

43RIESGO

abrir ↗

Nucleimedium

Custom 404 Pro < 3.2.8 - Cross-Site Scripting

CVE-2019-14789—

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.

18RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.