Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.324exploits catalogados
36.054CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.458Referência 22.721GitHub PoC 14.477VulnCheck XDB 8829Nuclei 4350Metasploit 3489✓ solo verificadosrecientespopularesriesgo
78.324 exploits
Metasploit600
Oracle WebLogic Server Administration Console Handle RCE
CVE-2020-14750CRITICALbajo ataque20 oct 2020
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RIESGO
abrir ↗
Metasploit600
Oracle WebLogic Server Administration Console Handle RCE
CVE-2020-14883HIGHbajo ataque20 oct 2020
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RIESGO
abrir ↗
Metasploit300
Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow
CVE-2020-14871CRITICALbajo ataque20 oct 2020
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve
100RIESGO
abrir ↗
Exploit-DB
HiSilicon video encoders - RCE via unauthenticated upload of malicious firmware
CVE-2020-24217—webappshardware19 oct 2020
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpo
35RIESGO
abrir ↗
GitHub PoC★ 7
ThinkAdmin CVE-2020-25540 poc
CVE-2020-25540—19 oct 2020
ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on
60RIESGO
abrir ↗
Exploit-DB
HiSilicon Video Encoders - RCE via unauthenticated command injection
CVE-2020-24217—webappshardware19 oct 2020
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpo
35RIESGO
abrir ↗
Exploit-DB
HiSilicon Video Encoders - Unauthenticated RTSP buffer overflow (DoS)
CVE-2020-24214—webappshardware19 oct 2020
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a
35RIESGO
abrir ↗
Exploit-DB
Typesetter CMS 5.1 - Arbitrary Code Execution (Authenticated)
CVE-2020-25790—webappsphp19 oct 2020
Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archi
28RIESGO
abrir ↗
Exploit-DB
HiSilicon Video Encoders - Unauthenticated file disclosure via path traversal
CVE-2020-24219—webappshardware19 oct 2020
An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthentic
28RIESGO
abrir ↗
Exploit-DB
HiSilicon Video Encoders - Full admin access via backdoor password
CVE-2020-24215—webappshardware19 oct 2020
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use har
28RIESGO
abrir ↗
Exploit-DB
Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in
CVE-2019-1003030CRITICALbajo ataquewebappsjava19 oct 2020
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/
100RIESGO
abrir ↗
Exploit-DB
Hostel Management System 2.1 - Cross Site Scripting (Multiple Fields)
CVE-2020-25270—webappsphp19 oct 2020
PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, o
23RIESGO
abrir ↗
GitHub PoC
datntsec/CVE-2019-13272
CVE-2019-13272HIGHbajo ataque19 oct 2020
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2017-5638CRITICALbajo ataqueransomware19 oct 2020
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RIESGO
abrir ↗
GitHub PoC
Exploitable target to CVE-2017-5638
CVE-2017-5638CRITICALbajo ataqueransomware19 oct 2020
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2020-25540—19 oct 2020
ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on
60RIESGO
abrir ↗
GitHub PoC
stealth-ronin/CVE-2017-0199-PY-KIT
CVE-2017-0199HIGHbajo ataqueransomware18 oct 2020
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RIESGO
abrir ↗
VulnCheck XDB
remote-with-credentials
CVE-2019-11447—18 oct 2020
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce
35RIESGO
abrir ↗
GitHub PoC
Exploits CuteNews 2.1.2 via poor file upload checks used when uploading an avatar image leading to RCE.
CVE-2019-11447—18 oct 2020
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce
35RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2020-7961CRITICALbajo ataque17 oct 2020
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RIESGO
abrir ↗
VulnCheck XDB
infoleak
CVE-2020-1472MEDIUMbajo ataqueransomware17 oct 2020
Netlogon Elevation of Privilege Vulnerability
100RIESGO
abrir ↗
GitHub PoC★ 5
C# Vulnerability Checker for CVE-2020-1472 Aka Zerologon
CVE-2020-1472MEDIUMbajo ataqueransomware17 oct 2020
Netlogon Elevation of Privilege Vulnerability
100RIESGO
abrir ↗
GitHub PoC★ 1
Converted with tweaks from a metasploit module as an exercise for OSCP studying and exploit development
CVE-2015-3306—16 oct 2020
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
60RIESGO
abrir ↗
Exploit-DB
Seat Reservation System 1.0 - Unauthenticated SQL Injection
CVE-2020-25762—webappsphp16 oct 2020
An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input v
28RIESGO
abrir ↗
VulnCheck XDB
infoleak
CVE-2020-1938CRITICALbajo ataque16 oct 2020
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RIESGO
abrir ↗
VulnCheck XDB
infoleak
CVE-2015-1635CRITICALbajo ataque16 oct 2020
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold an
100RIESGO
abrir ↗
VulnCheck XDB
initial-access
CVE-2019-15107CRITICALbajo ataqueransomware15 oct 2020
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RIESGO
abrir ↗
GitHub PoC★ 3
CVE-2019–15107 - Unauthenticated RCE Webmin <=1.920
CVE-2019-15107CRITICALbajo ataqueransomware15 oct 2020
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RIESGO
abrir ↗
GitHub PoC
Check for events that indicate non compatible devices -> CVE-2020-1472
CVE-2020-1472MEDIUMbajo ataqueransomware15 oct 2020
Netlogon Elevation of Privilege Vulnerability
100RIESGO
abrir ↗
VulnCheck XDB
infoleak
CVE-2020-5902CRITICALbajo ataqueransomware14 oct 2020
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RIESGO
abrir ↗
← anteriorpágina 727 / 2611siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.