Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.836exploits catalogados

32.133CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8156Nuclei 4201Metasploit 3462✓ solo verificadosrecientes populares riesgo

22.786 exploits

Exploit-DB

Airties AIR5444TT - Cross-Site Scripting

CVE-2018-8738—06 jul 2018

Airties 5444 1.0.0.18 and 5444TT 1.0.0.18 devices allow XSS.

23RIESGO

abrir ↗

Exploit-DB

ADB Broadband Gateways / Routers - Authorization Bypass

CVE-2018-13109—05 jul 2018

All ADB broadband gateways / routers based on the Epicentro platform are affected by an authorization bypass vulnerabili

35RIESGO

abrir ↗

Exploit-DB

ADB Broadband Gateways / Routers - Local Root Jailbreak

CVE-2018-13108—05 jul 2018

All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerabilit

23RIESGO

abrir ↗

Exploit-DB

ADB Broadband Gateways / Routers - Privilege Escalation

CVE-2018-13110—05 jul 2018

All ADB broadband gateways / routers based on the Epicentro platform are affected by a privilege escalation vulnerabilit

23RIESGO

abrir ↗

Exploit-DB

CMS Made Simple 2.2.5 - (Authenticated) Remote Code Execution

CVE-2018-1000094—04 jul 2018

CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows a

50RIESGO

abrir ↗

Exploit-DB

ShopNx - Arbitrary File Upload

CVE-2018-12519—04 jul 2018

An issue was discovered in ShopNx through 2017-11-17. The vulnerability allows a remote attacker to upload any malicious

23RIESGO

abrir ↗

Exploit-DB

Online Trade - Information Disclosure

CVE-2018-12908—04 jul 2018

Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensiti

28RIESGO

abrir ↗

Exploit-DB

Boxoft WAV to MP3 Converter 1.1 - Buffer Overflow (Metasploit)

CVE-2015-7243—03 jul 2018

Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly

50RIESGO

abrir ↗

Exploit-DB

ntop-ng < 3.4.180617 - Authentication Bypass

CVE-2018-12520—03 jul 2018

An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seede

28RIESGO

abrir ↗

Exploit-DB

VMware NSX SD-WAN Edge < 3.1.2 - Command Injection

CVE-2018-6961HIGHbajo ataque02 jul 2018

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web U

100RIESGO

abrir ↗

Exploit-DB

Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)

CVE-2018-8733—02 jul 2018

Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an

43RIESGO

abrir ↗

Exploit-DB

Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)

CVE-2018-8735—02 jul 2018

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut

50RIESGO

abrir ↗

Exploit-DB

FTPShell Client 6.70 (Enterprise Edition) - Stack Buffer Overflow (Metasploit)

CVE-2018-7573—02 jul 2018

An issue was discovered in FTPShell Client 6.7. A remote FTP server can send 400 characters of 'F' in conjunction with t

50RIESGO

abrir ↗

Exploit-DB

Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)

CVE-2018-8736—02 jul 2018

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RC

50RIESGO

abrir ↗

Exploit-DB

Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)

CVE-2018-8734—02 jul 2018

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker

50RIESGO

abrir ↗

Exploit-DB

Delta Industrial Automation COMMGR 1.08 - Stack Buffer Overflow (PoC)

CVE-2018-10594—02 jul 2018

Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPS

50RIESGO

abrir ↗

Exploit-DB

Cisco Adaptive Security Appliance - Path Traversal

CVE-2018-0296HIGHbajo ataque28 jun 2018

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remo

100RIESGO

abrir ↗

Exploit-DB

HongCMS 3.0.0 - (Authenticated) SQL Injection

CVE-2018-12912—28 jun 2018

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via a

23RIESGO

abrir ↗

Exploit-DB

BEESCMS 4.0 - Cross-Site Request Forgery (Add Admin)

CVE-2018-12739—28 jun 2018

In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266.

23RIESGO

abrir ↗

Exploit-DB

Quest KACE Systems Management - Command Injection (Metasploit)

CVE-2018-11138CRITICALbajo ataqueransomware27 jun 2018

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by

100RIESGO

abrir ↗

Exploit-DB

PoDoFo 0.9.5 - Buffer Overflow (PoC)

CVE-2018-8002—26 jun 2018

In PoDoFo 0.9.5, there exists an infinite loop vulnerability in PdfParserObject::ParseFileComplete() in PdfParserObject.

23RIESGO

abrir ↗

Exploit-DB

Foxit Reader 9.0.1.1049 - Remote Code Execution

CVE-2018-9948—25 jun 2018

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader

50RIESGO

abrir ↗

Exploit-DB

KVM (Nested Virtualization) - L1 Guest Privilege Escalation

CVE-2018-12904—25 jun 2018

In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause

23RIESGO

abrir ↗

Exploit-DB

WordPress Plugin Comments Import & Export < 2.0.4 - CSV Injection

CVE-2018-11526—25 jun 2018

The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.

23RIESGO

abrir ↗

Exploit-DB

WordPress Plugin iThemes Security < 7.0.3 - SQL Injection

CVE-2018-12636—25 jun 2018

The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admi

35RIESGO

abrir ↗

Exploit-DB

Foxit Reader 9.0.1.1049 - Remote Code Execution

CVE-2018-9958—25 jun 2018

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1

50RIESGO

abrir ↗

Exploit-DB

DIGISOL DG-BR4000NG - Buffer Overflow (PoC)

CVE-2018-12706—25 jun 2018

DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header.

28RIESGO

abrir ↗

Exploit-DB

WordPress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection

CVE-2018-11525—25 jun 2018

The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.

23RIESGO

abrir ↗

Exploit-DB

DIGISOL DG-BR4000NG - Cross-Site Scripting

CVE-2018-12705—25 jun 2018

DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).

23RIESGO

abrir ↗

Exploit-DB

Ecessa ShieldLink SL175EHQ < 10.7.4 - Cross-Site Request Forgery (Add Superuser)

CVE-2018-13032—25 jun 2018

ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/pl_web.cgi/util_configlogi

23RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.