Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.713exploits catalogados

39.298CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.379Exploit-DB 24.485GitHub PoC 16.200VulnCheck XDB 9648Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

4478 exploits

Nucleimedium

Cobub Razor 0.8.0 - Information Disclosure

CVE-2018-8770—

Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, contro

50RIESGO

abrir ↗

Nucleicritical

PrestaShop Responsive Mega Menu Module - Remote Code Execution

CVE-2018-8823—

modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for Pre

30RIESGO

abrir ↗

Nucleihigh

WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion

CVE-2018-9118—

exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Direct

50RIESGO

abrir ↗

Nucleicritical

PrismaWEB - Credentials Disclosure

CVE-2018-9161—

Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the

30RIESGO

abrir ↗

Nucleihigh

Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion

CVE-2018-9205—

Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.

50RIESGO

abrir ↗

Nucleicritical

Blueimp jQuery-File-Upload v9.22.0 - Unrestricted File Upload

CVE-2018-9206—

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

60RIESGO

abrir ↗

Nucleicritical

Etherpad Lite <1.6.4 - Admin Authentication Bypass

CVE-2018-9845—

Etherpad Lite before 1.6.4 is exploitable for admin access.

23RIESGO

abrir ↗

Nucleicritical

TBK DVR4104/DVR4216 Devices - Authentication Bypass

CVE-2018-9995—

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L

60RIESGO

abrir ↗

Nucleicritical

ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)

CVE-2019-10647—

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/con

18RIESGO

abrir ↗

Nucleicritical

Apache Solr - Deserialization of Untrusted Data

CVE-2019-0192—

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP

60RIESGO

abrir ↗

Nucleihigh

Apache Solr DataImportHandler <8.2.0 - Remote Code Execution

CVE-2019-0193HIGHbajo ataque

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources,

100RIESGO

abrir ↗

Nucleimedium

Apache Tomcat - Cross-Site Scripting

CVE-2019-0221—

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided

50RIESGO

abrir ↗

Nucleicritical

Apache Struts <=2.5.20 - Remote Code Execution

CVE-2019-0230—

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

60RIESGO

abrir ↗

Nucleihigh

Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution

CVE-2019-0232—

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RIESGO

abrir ↗

Nucleihigh

Jenkins Script Security Plugin <=1.49 - Sandbox Bypass

CVE-2019-1003000—

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/

60RIESGO

abrir ↗

Nucleicritical

D-Link Central WiFi Manager CWM(100) - Remote Code Execution

CVE-2019-13372—

/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote atta

40RIESGO

abrir ↗

Nucleimedium

MindPalette NateMail 3.0.15 - Cross-Site Scripting

CVE-2019-13392—

A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote

18RIESGO

abrir ↗

Nucleimedium

FlightPath - Local File Inclusion

CVE-2019-13396—

FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an in

50RIESGO

abrir ↗

Nucleicritical

Lansweeper Unauthenticated SQL Injection

CVE-2019-13462—

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.

23RIESGO

abrir ↗

Nucleihigh

Citrix StoreFront Server - XML External Entity

CVE-2019-13608HIGHbajo ataqueransomware

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE at

78RIESGO

abrir ↗

Nucleihigh

WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion

CVE-2019-14205—

A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attac

30RIESGO

abrir ↗

Nucleihigh

Nevma Adaptive Images - Arbitrary File Deletion

CVE-2019-14206—

An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote a

38RIESGO

abrir ↗

Nucleimedium

Alfresco Share - Open Redirect

CVE-2019-14223—

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share applicat

18RIESGO

abrir ↗

Nucleihigh

T24 Web Server - Local File Inclusion

CVE-2019-14251—

An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a docu

18RIESGO

abrir ↗

Nucleimedium

Aptana Jaxer 1.0.3.4547 - Local File inclusion

CVE-2019-14312—

Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This v

43RIESGO

abrir ↗

Nucleihigh

Pallets Werkzeug <0.15.5 - Local File Inclusion

CVE-2019-14322—

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

50RIESGO

abrir ↗

Nucleimedium

WordPress UserPro 4.9.32 - Cross-Site Scripting

CVE-2019-14470—

cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has X

60RIESGO

abrir ↗

Nucleihigh

OpenEMR <5.0.2 - Local File Inclusion

CVE-2019-14530—

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can

50RIESGO

abrir ↗

Nucleimedium

Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting

CVE-2019-14696—

Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.

43RIESGO

abrir ↗

Nucleimedium

osTicket < 1.12.1 - Cross-Site Scripting

CVE-2019-14750—

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It w

43RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.