Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.741exploits catalogados

39.318CVEs con explotación pública

24.695probados en laboratorio

Todos Referência 25.394Exploit-DB 24.485GitHub PoC 16.210VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientes populares riesgo

4478 exploits

Nucleicritical

Responsive filemanager 9.13.1 Server-Side Request Forgery

CVE-2018-14728—

upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.

60RIESGO

abrir ↗

Nucleihigh

cgit < 1.2.1 - Directory Traversal

CVE-2018-14912—

cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned

60RIESGO

abrir ↗

Nucleicritical

Loytec LGATE-902 <6.4.2 - Local File Inclusion

CVE-2018-14916—

LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.

23RIESGO

abrir ↗

Nucleihigh

LOYTEC LGATE-902 6.3.2 - Local File Inclusion

CVE-2018-14918—

LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.

23RIESGO

abrir ↗

Nucleimedium

Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect

CVE-2018-14931—

An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. An open redirect exis

18RIESGO

abrir ↗

Nucleicritical

NUUO NVRmini - Remote Command Execution

CVE-2018-14933CRITICALbajo ataque

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir par

100RIESGO

abrir ↗

Nucleihigh

LG-Ericsson iPECS NMS 30M - Local File Inclusion

CVE-2018-15138—

Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs.

23RIESGO

abrir ↗

Nucleihigh

D-Link Central WifiManager - Server-Side Request Forgery

CVE-2018-15517—

The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an

30RIESGO

abrir ↗

Nucleihigh

Responsive FileManager <9.13.4 - Local File Inclusion

CVE-2018-15535—

/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname

50RIESGO

abrir ↗

Nucleihigh

Argus Surveillance DVR 4.0.0.0 - Local File Inclusion

CVE-2018-15745—

Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F

60RIESGO

abrir ↗

Nucleihigh

DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization

CVE-2018-15811HIGHbajo ataque

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

100RIESGO

abrir ↗

Nucleimedium

Jorani Leave Management System 0.6.5 - Cross-Site Scripting

CVE-2018-15917—

Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HT

38RIESGO

abrir ↗

Nucleicritical

Adobe ColdFusion - Unrestricted File Upload Remote Code Execution

CVE-2018-15961CRITICALbajo ataque

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr

100RIESGO

abrir ↗

Nucleimedium

WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion

CVE-2018-16059—

Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename par

43RIESGO

abrir ↗

Nucleimedium

Cybrotech CyBroHttpServer 1.0.3 - Local File Inclusion

CVE-2018-16133—

Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.

50RIESGO

abrir ↗

Nucleimedium

BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting

CVE-2018-16139—

Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web sc

18RIESGO

abrir ↗

Nucleicritical

WordPress Gift Voucher <4.1.8 - Blind SQL Injection

CVE-2018-16159—

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/ad

30RIESGO

abrir ↗

Nucleicritical

LogonTracer <=1.2.0 - Remote Command Injection

CVE-2018-16167—

LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

60RIESGO

abrir ↗

Nucleicritical

WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion

CVE-2018-16283—

The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.

50RIESGO

abrir ↗

Nucleihigh

LG SuperSign EZ CMS 2.5 - Local File Inclusion

CVE-2018-16288—

LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.

50RIESGO

abrir ↗

Nucleicritical

Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection

CVE-2018-6605—

SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, get

50RIESGO

abrir ↗

Nucleimedium

Zimbra Collaboration Suite - Cross-site Scripting

CVE-2018-6882MEDIUMbajo ataqueransomware

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Sui

63RIESGO

abrir ↗

Nucleihigh

DedeCMS 5.7 - Path Disclosure

CVE-2018-6910—

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/in

23RIESGO

abrir ↗

Nucleicritical

VMware NSX SD-WAN Edge - Command Injection

CVE-2018-6961HIGHbajo ataque

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web U

100RIESGO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7192—

Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remot

18RIESGO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7193—

Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attac

18RIESGO

abrir ↗

Nucleimedium

osTicket < 1.10.2 - Cross-Site Scripting

CVE-2018-7196—

Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers

18RIESGO

abrir ↗

Nucleicritical

Anchor CMS 0.12.3 - Error Log Exposure

CVE-2018-7251—

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contain

60RIESGO

abrir ↗

Nucleicritical

TITool PrintMonitor - Blind SQL Injection

CVE-2018-7282—

The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based b

23RIESGO

abrir ↗

Nucleicritical

Joomla! Component PrayerCenter 3.0.2 - SQL Injection

CVE-2018-7314—

SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerabil

50RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.