Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.780exploits catalogados
39.319CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB✓ VexDay Proof
WebKit JIT - 'ByteCodeParser::handleIntrinsicCall' Type Confusion
CVE-2018-4382—dosmultiple29 nov 2018
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iO
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
PHP imap_open - Remote Code Execution (Metasploit)
CVE-2018-19518—remotelinux29 nov 2018
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh c
60RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Mac OS X - libxpc MITM Privilege Escalation (Metasploit)
CVE-2018-4237—localmacos29 nov 2018
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
43RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Linux - Nested User Namespace idmap Limit Local Privilege Escalation (Metasploit)
CVE-2018-18955—locallinux29 nov 2018
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat
38RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Netgear Devices - (Unauthenticated) Remote Command Execution (Metasploit)
CVE-2016-1555CRITICALbajo ataqueremotehardware27 nov 2018
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
100RIESGO
abrir ↗
Exploit-DB
Ticketly 1.0 - 'kind_id' SQL Injection
CVE-2018-18923—webappsphp26 nov 2018
AbiSoft Ticketly 1.0 is affected by multiple SQL Injection vulnerabilities through the parameters name, category_id and
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Xorg X11 Server - SUID privilege escalation (Metasploit)
CVE-2018-14665—localmultiple26 nov 2018
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RIESGO
abrir ↗
Exploit-DB
Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method)
CVE-2018-18955—locallinux21 nov 2018
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat
38RIESGO
abrir ↗
Exploit-DB
Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method)
CVE-2018-18955—locallinux21 nov 2018
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat
38RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - DfMarshal Unsafe Unmarshaling Privilege Escalation
CVE-2018-8550—localwindows20 nov 2018
An elevation of privilege exists in Windows COM Aggregate Marshaler, aka "Windows COM Elevation of Privilege Vulnerabili
23RIESGO
abrir ↗
Exploit-DB
ImageMagick - Memory Leak
CVE-2018-16323—localmultiple19 nov 2018
ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that ha
35RIESGO
abrir ↗
Exploit-DB
DomainMOD 4.11.01 - 'raid' Cross-Site Scripting
CVE-2018-19136—webappsphp16 nov 2018
DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.
38RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Linux - Broken uid/gid Mapping for Nested User Namespaces
CVE-2018-18955—locallinux16 nov 2018
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat
38RIESGO
abrir ↗
Exploit-DB
PHP-Proxy 5.1.0 - Local File Inclusion
CVE-2018-19246—webappsphp15 nov 2018
PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users w
28RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Ninja Forms 3.3.17 - Cross-Site Scripting
CVE-2018-19287—webappsphp15 nov 2018
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes
38RIESGO
abrir ↗
Exploit-DB
SwitchVPN for macOS 2.1012.03 - Privilege Escalation
CVE-2018-18860—localmacos14 nov 2018
A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03 for macOS. Due to over-
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Dell OpenManage Network Manager 6.2.0.51 SP3 - Multiple Vulnerabilities
CVE-2018-15767—webappslinux14 nov 2018
Improper Authorization Vulnerability
28RIESGO
abrir ↗
Exploit-DB
ntpd 4.2.8p10 - Out-of-Bounds Read (PoC)
CVE-2018-7182—locallinux14 nov 2018
The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-
28RIESGO
abrir ↗
Exploit-DB
Advanced Comment System 1.0 - SQL Injection
CVE-2018-18619—webappsphp14 nov 2018
internal/advanced_comment_system/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability bec
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Dell OpenManage Network Manager 6.2.0.51 SP3 - Multiple Vulnerabilities
CVE-2018-15768—webappslinux14 nov 2018
Insecure MySQL Configuration Vulnerability
23RIESGO
abrir ↗
Exploit-DB
ClipperCMS 1.3.3 - Cross-Site Request Forgery (File Upload)
CVE-2018-19135—webappsphp13 nov 2018
ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an
23RIESGO
abrir ↗
Exploit-DB
CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2018-18772—webappsphp13 nov 2018
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as dem
23RIESGO
abrir ↗
Exploit-DB
xorg-x11-server < 1.20.1 - Local Privilege Escalation
CVE-2018-14665—locallinux13 nov 2018
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Cisco Immunet < 6.2.0 / Cisco AMP For Endpoints 6.2.0 - Denial of Service
CVE-2018-15437MEDIUMdoswindows13 nov 2018
Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability
33RIESGO
abrir ↗
Exploit-DB
CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2018-18774—webappsphp13 nov 2018
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.
23RIESGO
abrir ↗
Exploit-DB
CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2018-18773—webappsphp13 nov 2018
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demo
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
Evince 3.24.0 - Command Injection
CVE-2017-1000083—doslinux13 nov 2018
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
50RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Media File Manager 1.4.2 - Directory Traversal / Cross-Site Scripting
CVE-2018-19042—webappsphp12 nov 2018
The Media File Manager plugin 1.4.2 for WordPress allows arbitrary file movement via a ../ directory traversal in the di
28RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Media File Manager 1.4.2 - Directory Traversal / Cross-Site Scripting
CVE-2018-19041—webappsphp12 nov 2018
The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the
23RIESGO
abrir ↗
Exploit-DB
WordPress Plugin Media File Manager 1.4.2 - Directory Traversal / Cross-Site Scripting
CVE-2018-19040—webappsphp12 nov 2018
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir para
28RIESGO
abrir ↗
← anteriorpágina 81 / 817siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.