Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.780exploits catalogados
39.319CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB
WordPress Plugin Media File Manager 1.4.2 - Directory Traversal / Cross-Site Scripting
CVE-2018-19040—webappsphp12 nov 2018
The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir para
28RIESGO
abrir ↗
Exploit-DB
OpenSLP 2.0.0 - Multiple Vulnerabilities
CVE-2016-7567—locallinux07 nov 2018
Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP 2.0 allows remote attackers to have
28RIESGO
abrir ↗
Exploit-DB
libiec61850 1.3 - Stack Based Buffer Overflow
CVE-2018-18957—locallinux06 nov 2018
An issue has been found in libIEC61850 v1.3. It is a stack-based buffer overflow in prepareGooseBuffer in goose/goose_pu
28RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
FaceTime - 'readSPSandGetDecoderParams' Stack Corruption
CVE-2018-4367—dosmacos06 nov 2018
A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
FaceTime - 'VCPDecompressionDecodeFrame' Memory Corruption
CVE-2018-4366—dosmacos06 nov 2018
A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
FaceTime - RTP Video Processing Heap Corruption
CVE-2018-4384—dosios06 nov 2018
A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1,
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
blueimp's jQuery 9.22.0 - (Arbitrary) File Upload (Metasploit)
CVE-2018-9206—remotephp06 nov 2018
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RIESGO
abrir ↗
Exploit-DB
CMS Made Simple 2.2.7 - (Authenticated) Remote Code Execution
CVE-2018-10517—webappsphp06 nov 2018
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code ex
28RIESGO
abrir ↗
Exploit-DB
Royal TS/X - Information Disclosure
CVE-2018-18865—webappsjson05 nov 2018
The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13
23RIESGO
abrir ↗
Exploit-DB
LiquidVPN 1.36 / 1.37 - Privilege Escalation
CVE-2018-18856—localmacos05 nov 2018
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RIESGO
abrir ↗
Exploit-DB
LiquidVPN 1.36 / 1.37 - Privilege Escalation
CVE-2018-18857—localmacos05 nov 2018
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RIESGO
abrir ↗
Exploit-DB
LiquidVPN 1.36 / 1.37 - Privilege Escalation
CVE-2018-18859—localmacos05 nov 2018
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RIESGO
abrir ↗
Exploit-DB
LiquidVPN 1.36 / 1.37 - Privilege Escalation
CVE-2018-18858—localmacos05 nov 2018
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RIESGO
abrir ↗
Exploit-DB
Advantech WebAccess SCADA 8.3.2 - Remote Code Execution
CVE-2018-15705—webappsasp05 nov 2018
WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any f
28RIESGO
abrir ↗
Exploit-DB
PHP Proxy 3.0.3 - Local File Inclusion
CVE-2018-19458—webappsphp05 nov 2018
In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI UR
50RIESGO
abrir ↗
Exploit-DB
Advantech WebAccess SCADA 8.3.2 - Remote Code Execution
CVE-2018-15707—webappsasp05 nov 2018
Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could
23RIESGO
abrir ↗
Exploit-DB
Intel (Skylake / Kaby Lake) - 'PortSmash' CPU SMT Side-Channel
CVE-2018-5407—localhardware02 nov 2018
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks
23RIESGO
abrir ↗
Exploit-DB
Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal
CVE-2018-18777—webappsjsp30 oct 2018
Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subp
43RIESGO
abrir ↗
Exploit-DB
Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal
CVE-2018-18776—webappsjsp30 oct 2018
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (
23RIESGO
abrir ↗
Exploit-DB
Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal
CVE-2018-18775—webappsjsp30 oct 2018
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (
38RIESGO
abrir ↗
Exploit-DB
xorg-x11-server 1.20.3 - Privilege Escalation
CVE-2018-14665—localopenbsd30 oct 2018
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
systemd - 'reexec' State Injection
CVE-2018-15686HIGHdoslinux29 oct 2018
systemd: reexec state injection: fgets() on overlong lines leads to line splitting
41RIESGO
abrir ↗
Exploit-DB
School Event Management System 1.0 - Cross-Site Request Forgery (Update Admin)
CVE-2018-18794—webappsphp29 oct 2018
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
23RIESGO
abrir ↗
Exploit-DB
Bakeshop Inventory System in VB.Net and MS Access Database 1.0 - SQL Injection
CVE-2018-18804—webappsphp29 oct 2018
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
23RIESGO
abrir ↗
Exploit-DB
Point of Sales (POS) in VB.Net MySQL Database 1.0 - SQL Injection
CVE-2018-18805—webappsphp29 oct 2018
Point Of Sales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb.
23RIESGO
abrir ↗
Exploit-DB
RhinOS CMS 3.x - Arbitrary File Download
CVE-2018-18760—webappsphp29 oct 2018
RhinOS 3.0 build 1190 allows CSRF.
23RIESGO
abrir ↗
Exploit-DB
School Event Management System 1.0 - SQL Injection
CVE-2018-18795—webappsphp29 oct 2018
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
23RIESGO
abrir ↗
Exploit-DB
ASRock Drivers - Privilege Escalation
CVE-2018-10710—doswindows29 oct 2018
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Str
23RIESGO
abrir ↗
Exploit-DB
School Attendance Monitoring System 1.0 - SQL Injection
CVE-2018-18798—webappsphp29 oct 2018
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph
23RIESGO
abrir ↗
Exploit-DB✓ VexDay Proof
systemd - 'chown_one()' Dereference Symlinks
CVE-2018-15687HIGHlocallinux29 oct 2018
systemd: chown_one() can dereference symlinks
41RIESGO
abrir ↗
← anteriorpágina 82 / 817siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.