Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados

36.206CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientes populares riesgo

78.958 exploits

Metasploit600

Oracle WebLogic Server Administration Console Handle RCE

CVE-2020-14883HIGHbajo ataque20 oct 2020

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RIESGO

abrir ↗

Metasploit600

Oracle WebLogic Server Administration Console Handle RCE

CVE-2020-14882CRITICALbajo ataque20 oct 2020

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RIESGO

abrir ↗

Metasploit300

Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow

CVE-2020-14871CRITICALbajo ataque20 oct 2020

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve

100RIESGO

abrir ↗

Metasploit600

NSClient++ 0.5.2.35 - Privilege escalation

CVE-2025-34078HIGH20 oct 2020

NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface

36RIESGO

abrir ↗

Metasploit600

NSClient++ 0.5.2.35 - ExternalScripts Authenticated Remote Code Execution

CVE-2025-34079HIGH20 oct 2020

NSClient++ Authenticated Remote Code Execution via ExternalScripts API

36RIESGO

abrir ↗

Metasploit600

Nagios XI 5.5.0-5.7.3 - Snmptrap Authenticated Remote Code Exection

CVE-2020-5792—20 oct 2020

Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user

30RIESGO

abrir ↗

Metasploit600

Nagios XI 5.6.0-5.7.3 - Mibs.php Authenticated Remote Code Exection

CVE-2020-5791—20 oct 2020

Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admi

60RIESGO

abrir ↗

GitHub PoC★ 2

cve-2020-14644 漏洞环境

CVE-2020-14644CRITICALbajo ataque20 oct 2020

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions th

100RIESGO

abrir ↗

Exploit-DB

Hostel Management System 2.1 - Cross Site Scripting (Multiple Fields)

CVE-2020-25270—webappsphp19 oct 2020

PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, o

23RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2017-5638CRITICALbajo ataqueransomware19 oct 2020

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2020-25540—19 oct 2020

ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on

60RIESGO

abrir ↗

GitHub PoC

datntsec/CVE-2019-13272

CVE-2019-13272HIGHbajo ataque19 oct 2020

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce

98RIESGO

abrir ↗

Exploit-DB

Typesetter CMS 5.1 - Arbitrary Code Execution (Authenticated)

CVE-2020-25790—webappsphp19 oct 2020

Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archi

28RIESGO

abrir ↗

Exploit-DB

HiSilicon Video Encoders - RCE via unauthenticated command injection

CVE-2020-24217—webappshardware19 oct 2020

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpo

35RIESGO

abrir ↗

Exploit-DB

HiSilicon Video Encoders - Unauthenticated RTSP buffer overflow (DoS)

CVE-2020-24214—webappshardware19 oct 2020

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a

35RIESGO

abrir ↗

Exploit-DB

HiSilicon video encoders - RCE via unauthenticated upload of malicious firmware

CVE-2020-24217—webappshardware19 oct 2020

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpo

35RIESGO

abrir ↗

GitHub PoC★ 7

ThinkAdmin CVE-2020-25540 poc

CVE-2020-25540—19 oct 2020

ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on

60RIESGO

abrir ↗

Exploit-DB

HiSilicon Video Encoders - Full admin access via backdoor password

CVE-2020-24215—webappshardware19 oct 2020

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use har

28RIESGO

abrir ↗

Exploit-DB

HiSilicon Video Encoders - Unauthenticated file disclosure via path traversal

CVE-2020-24219—webappshardware19 oct 2020

An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthentic

28RIESGO

abrir ↗

GitHub PoC

Exploitable target to CVE-2017-5638

CVE-2017-5638CRITICALbajo ataqueransomware19 oct 2020

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RIESGO

abrir ↗

Exploit-DB

Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in

CVE-2019-1003030CRITICALbajo ataquewebappsjava19 oct 2020

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/

100RIESGO

abrir ↗

GitHub PoC

stealth-ronin/CVE-2017-0199-PY-KIT

CVE-2017-0199HIGHbajo ataqueransomware18 oct 2020

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window

100RIESGO

abrir ↗

VulnCheck XDB

remote-with-credentials

CVE-2019-11447—18 oct 2020

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce

35RIESGO

abrir ↗

GitHub PoC

Exploits CuteNews 2.1.2 via poor file upload checks used when uploading an avatar image leading to RCE.

CVE-2019-11447—18 oct 2020

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce

35RIESGO

abrir ↗

VulnCheck XDB

infoleak

CVE-2020-1472MEDIUMbajo ataqueransomware17 oct 2020

Netlogon Elevation of Privilege Vulnerability

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2020-7961CRITICALbajo ataque17 oct 2020

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RIESGO

abrir ↗

GitHub PoC★ 5

C# Vulnerability Checker for CVE-2020-1472 Aka Zerologon

CVE-2020-1472MEDIUMbajo ataqueransomware17 oct 2020

Netlogon Elevation of Privilege Vulnerability

100RIESGO

abrir ↗

GitHub PoC★ 1

Converted with tweaks from a metasploit module as an exercise for OSCP studying and exploit development

CVE-2015-3306—16 oct 2020

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

60RIESGO

abrir ↗

VulnCheck XDB

infoleak

CVE-2015-1635CRITICALbajo ataque16 oct 2020

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold an

100RIESGO

abrir ↗

VulnCheck XDB

infoleak

CVE-2020-1938CRITICALbajo ataque16 oct 2020

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.