Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.780exploits catalogados
39.319CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB
PrestaShop 1.6.x/1.7.x - Remote Code Execution
CVE-2018-19125—webappsphp11 dic 2018
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
McAfee True Key - McAfee.TrueKey.Service Privilege Escalation
CVE-2018-6755HIGHlocalwindows11 dic 2018
True Key (TK) Windows Client - Weak Directory Permission Vulnerability
41RIESGO
abrir ↗
Exploit-DB
Kubernetes - (Unauthenticated) Arbitrary Requests
CVE-2018-1002105CRITICALremotemultiple10 dic 2018
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg
70RIESGO
abrir ↗
Exploit-DB
Kubernetes - (Authenticated) Arbitrary Requests
CVE-2018-1002105CRITICALremotemultiple10 dic 2018
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg
70RIESGO
abrir ↗
Exploit-DB
Adiscon LogAnalyzer < 4.1.7 - Cross-Site Scripting
CVE-2018-19877—webappsphp09 dic 2018
login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.
43RIESGO
abrir ↗
Exploit-DB
FreshRSS 1.11.1 - Cross-Site Scripting
CVE-2018-19782—webappsphp04 dic 2018
Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject
23RIESGO
abrir ↗
Exploit-DB
DomainMOD 4.11.01 - Registrar Cross-Site Scripting
CVE-2018-19752—webappsphp04 dic 2018
DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
38RIESGO
abrir ↗
Exploit-DB
Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass
CVE-2018-19616—webappshardware04 dic 2018
An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/rem
35RIESGO
abrir ↗
Exploit-DB
NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage
CVE-2018-11742—webappshardware04 dic 2018
NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.
28RIESGO
abrir ↗
Exploit-DB
OpenSSH < 7.7 - User Enumeration (2)
CVE-2018-15473MEDIUMremotelinux04 dic 2018
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RIESGO
abrir ↗
Exploit-DB
DomainMOD 4.11.01 - Custom Domain Fields Cross-Site Scripting
CVE-2018-19750—webappsphp04 dic 2018
DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Doma
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Wireshark - 'find_signature' Heap Out-of-Bounds Read
CVE-2018-19627—dosmultiple04 dic 2018
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/v
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
HP Intelligent Management - Java Deserialization Remote Code Execution (Metasploit)
CVE-2017-12557—remotewindows04 dic 2018
A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and e
60RIESGO
abrir ↗
Exploit-DB
DomainMOD 4.11.01 - Owner name Field Cross-Site Scripting
CVE-2018-19749—webappsphp04 dic 2018
DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.
38RIESGO
abrir ↗
Exploit-DB
NEC Univerge Sv9100 WebPro - 6.00 - Predictable Session ID / Clear Text Password Storage
CVE-2018-11741—webappshardware04 dic 2018
NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure vi
28RIESGO
abrir ↗
Exploit-DB
NUUO NVRMini2 3.9.1 - (Authenticated) Command Injection
CVE-2018-15716—webappsphp04 dic 2018
NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted reques
28RIESGO
abrir ↗
Exploit-DB
Dolibarr ERP/CRM 8.0.3 - Cross-Site Scripting
CVE-2018-19799—webappsphp04 dic 2018
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Lync for Mac 2011 - Injection Forced Browsing/Download
CVE-2018-8474—doswindows04 dic 2018
A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messa
35RIESGO
abrir ↗
Exploit-DB
Xorg X11 Server (AIX) - Local Privilege Escalation
CVE-2018-14665—localaix04 dic 2018
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RIESGO
abrir ↗
Exploit-DB
DomainMOD 4.11.01 - Custom SSL Fields Cross-Site Scripting
CVE-2018-19751—webappsphp04 dic 2018
DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.
38RIESGO
abrir ↗
Exploit-DB
Apache Superset < 0.23 - Remote Code Execution
CVE-2018-8021—webappslinux03 dic 2018
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to pos
35RIESGO
abrir ↗
Exploit-DB
CyberArk 9.7 - Memory Disclosure
CVE-2018-9842—remotewindows03 dic 2018
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
VBScript - 'OLEAUT32!VariantClear' and 'scrrun!VBADictionary::put_Item' Use-After-Free
CVE-2018-8544—doswindows30 nov 2018
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
35RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
VBScript - 'rtFilter' Out-of-Bounds Read
CVE-2018-8552—doswindows30 nov 2018
An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which coul
35RIESGO
abrir ↗
Exploit-DB
Schneider Electric PLC - Session Calculation Authentication Bypass
CVE-2017-6026—webappshardware30 nov 2018
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware ver
35RIESGO
abrir ↗
Exploit-DB
xorg-x11-server < 1.20.3 - 'modulepath' Local Privilege Escalation
CVE-2018-14665—localmultiple30 nov 2018
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RIESGO
abrir ↗
Exploit-DB
PhpSpreadsheet < 1.5.0 - XML External Entity (XXE)
CVE-2018-19277—webappsphp30 nov 2018
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 enco
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
WebKit JIT - 'ByteCodeParser::handleIntrinsicCall' Type Confusion
CVE-2018-4382—dosmultiple29 nov 2018
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iO
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Linux - Nested User Namespace idmap Limit Local Privilege Escalation (Metasploit)
CVE-2018-18955—locallinux29 nov 2018
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat
38RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Mac OS X - libxpc MITM Privilege Escalation (Metasploit)
CVE-2018-4237—localmacos29 nov 2018
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
43RIESGO
abrir ↗
← anteriorpágina 80 / 817siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.