Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.186exploits catalogados
40.156CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.041Exploit-DB 24.488GitHub PoC 17.609VulnCheck XDB 9976Nuclei 4542Metasploit 3530✓ solo verificadosrecientespopularesriesgo
86.186 exploits
GitHub PoC★ 2
reversebrain/CVE-2019-18988
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for dif
86RIESGO
abrir ↗VulnCheck XDB
local
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for dif
86RIESGO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions th
100RIESGO
abrir ↗VulnCheck XDB
local
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperl
98RIESGO
abrir ↗Metasploit600
openSIS Unauthenticated PHP Code Execution
openSIS through 7.4 allows SQL Injection.
30RIESGO
abrir ↗Metasploit200
F5 BIG-IP TMUI Directory Traversal and File Upload RCE
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RIESGO
abrir ↗Metasploit600
openSIS Unauthenticated PHP Code Execution
openSIS through 7.4 has Incorrect Access Control.
30RIESGO
abrir ↗Metasploit600
openSIS Unauthenticated PHP Code Execution
openSIS through 7.4 allows Directory Traversal.
30RIESGO
abrir ↗GitHub PoC★ 1
Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure (Python3)
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote
60RIESGO
abrir ↗GitHub PoC★ 19
CVE-2013-2028 python exploit
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
60RIESGO
abrir ↗GitHub PoC
cyberharsh/Shellbash-CVE-2014-6271
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
100RIESGO
abrir ↗GitHub PoC★ 1
cyberharsh/DrupalCVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
100RIESGO
abrir ↗Exploit-DB
mySCADA myPRO 7 - Hardcoded Credentials
A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attack
28RIESGO
abrir ↗GitHub PoC
cyberharsh/Tomcat-CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati
100RIESGO
abrir ↗GitHub PoC
cyberharsh/Php-unit-CVE-2017-9841
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RIESGO
abrir ↗GitHub PoC
Bludit 3.9.2 - bruteforce bypass - CVE-2019-17240
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many
40RIESGO
abrir ↗GitHub PoC★ 1
cyberharsh/Oracle-mysql-CVE-2012-2122
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
60RIESGO
abrir ↗Exploit-DB
Lansweeper 7.2 - Incorrect Access Control
Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin accoun
28RIESGO
abrir ↗Exploit-DB
WebPort 1.19.1 - 'setup' Reflected Cross-Site Scripting
Web Port 1.19.1 allows XSS via the /access/setup type parameter.
23RIESGO
abrir ↗GitHub PoC★ 1
Python version of Metasploit exploit for CVE-2004-1561
Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with
60RIESGO
abrir ↗Metasploit600
Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution
Rockwell Automation FactoryTalk View SE
48RIESGO
abrir ↗Metasploit600
Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution
Rockwell Automation FactoryTalk View SE
40RIESGO
abrir ↗Metasploit600
Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution
Rockwell Automation FactoryTalk View SE
75RIESGO
abrir ↗GitHub PoC
cyberharsh/Groovy-scripting-engine-CVE-2015-1427
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
100RIESGO
abrir ↗Exploit-DB
FileRun 2019.05.21 - Reflected Cross-Site Scripting
FileRun 2019.05.21 allows XSS via the filename to the ?module=fileman§ion=do&page=up URI. This issue has been fixed
23RIESGO
abrir ↗Exploit-DB
WebPort 1.19.1 - Reflected Cross-Site Scripting
Web Port 1.19.1 allows XSS via the /log type parameter.
38RIESGO
abrir ↗VulnCheck XDB
initial-access
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Suppor
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.