Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.292exploits catalogados

31.741CVEs con explotación pública

0probados en laboratorio

Todos Exploit-DB 22.469Referência 19.888GitHub PoC 13.182VulnCheck XDB 8100Nuclei 4191Metasploit 3462✓ solo verificadosrecientes populares riesgo

4191 exploits

Nucleicritical

phpMyAdmin < 5.0.3 - SQL Injection

CVE-2020-26935—

An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerabili

30RIESGO

abrir ↗

Nucleicritical

Emby < 4.5.0 - Server Server-Side Request Forgery

CVE-2020-26948—

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.

40RIESGO

abrir ↗

Nucleihigh

LionWiki <3.2.12 - Local File Inclusion

CVE-2020-27191—

LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the ind

18RIESGO

abrir ↗

Nucleicritical

JD Edwards EnterpriseOne Tools 9.2 - Information Disclosure

CVE-2020-2733CRITICAL

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics)

68RIESGO

abrir ↗

Nucleihigh

Akkadian Provisioning Manager 4.50.02 - Sensitive Information Disclosure

CVE-2020-27361—

An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within

18RIESGO

abrir ↗

Nucleihigh

Processwire CMS <2.7.1 - Local File Inclusion

CVE-2020-27467—

A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.

23RIESGO

abrir ↗

Nucleicritical

Good Layers LMS Plugin <= 2.1.4 - SQL Injection

CVE-2020-27481—

An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_no

23RIESGO

abrir ↗

Nucleicritical

WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter

CVE-2020-27615—

The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_fa

30RIESGO

abrir ↗

Nucleimedium

Wing FTP 6.4.4 - Cross-Site Scripting

CVE-2020-27735—

An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a craft

18RIESGO

abrir ↗

Nucleimedium

KeyCloak - Information Exposure

CVE-2020-27838—

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information a

23RIESGO

abrir ↗

Nucleihigh

NETGEAR - Authentication Bypass

CVE-2020-27866HIGH

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020

36RIESGO

abrir ↗

Nucleimedium

IceWarp WebMail 11.4.5.0 - Cross-Site Scripting

CVE-2020-27982—

IceWarp 11.4.5.0 allows XSS via the language parameter.

18RIESGO

abrir ↗

Nucleihigh

SonarQube - Authentication Bypass

CVE-2020-27986HIGH

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settin

41RIESGO

abrir ↗

Nucleimedium

TerraMaster TOS < 4.2.06 - User Enumeration

CVE-2020-28185—

User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid us

23RIESGO

abrir ↗

Nucleicritical

TerraMaster TOS - Unauthenticated Remote Command Execution

CVE-2020-28188—

Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inje

40RIESGO

abrir ↗

Nucleimedium

Rocket.Chat <3.9.1 - Information Disclosure

CVE-2020-28208—

An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.

23RIESGO

abrir ↗

Nucleimedium

Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting

CVE-2020-28351—

The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a r

43RIESGO

abrir ↗

Nucleicritical

geojson2kml - Command Injection

CVE-2020-28429HIGH

Command Injection

48RIESGO

abrir ↗

Nucleicritical

ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization

CVE-2020-28653—

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution v

60RIESGO

abrir ↗

Nucleicritical

Monitorr 1.7.6m - Unauthenticated Remote Code Execution

CVE-2020-28871—

Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the s

40RIESGO

abrir ↗

Nucleimedium

WordPress Canto 1.3.0 - Blind Server-Side Request Forgery

CVE-2020-28976—

The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make

43RIESGO

abrir ↗

Nucleicritical

WP Hotel Booking < 1.10.4 - PHP Object Injection

CVE-2020-29047—

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an

23RIESGO

abrir ↗

Nucleimedium

PacsOne Server <7.1.1 - Cross-Site Scripting

CVE-2020-29164—

PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS).

18RIESGO

abrir ↗

Nucleicritical

Alumni Management System 1.0 - SQL Injection

CVE-2020-29214—

SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypa

18RIESGO

abrir ↗

Nucleicritical

Car Rental Management System 1.0 - Local File Inclusion

CVE-2020-29227—

An issue was discovered in Car Rental Management System 1.0. An unauthenticated user can perform a file inclusion attack

23RIESGO

abrir ↗

Nucleicritical

74CMS - Remote File Inclusion

CVE-2020-29279—

PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 7

30RIESGO

abrir ↗

Nucleicritical

Zeroshell 3.9.3 - Command Injection

CVE-2020-29390—

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that co

30RIESGO

abrir ↗

Nucleimedium

Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting

CVE-2020-29395—

The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.

43RIESGO

abrir ↗

Nucleimedium

Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)

CVE-2020-29453—

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 befor

23RIESGO

abrir ↗

Nucleicritical

ZyXel USG - Hardcoded Credentials

CVE-2020-29583CRITICALbajo ataque

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The p

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.