Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.508exploits catalogados
40.258CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.095Exploit-DB 24.488GitHub PoC 17.831VulnCheck XDB 10.015Nuclei 4547Metasploit 3532✓ solo verificadosrecientespopularesriesgo
86.508 exploits
Metasploit600
IBM Data Risk Manager Unauthenticated Remote Code Execution
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security rest
95RIESGO
abrir ↗Metasploit600
IBM Data Risk Manager Unauthenticated Remote Code Execution
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary co
85RIESGO
abrir ↗Exploit-DB
Neowise CarbonFTP 1.4 - Insecure Proprietary Password Encryption
CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FT
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Unraid 6.8.0 - Auth Bypass PHP Code Execution (Metasploit)
Unraid 6.8.0 allows authentication bypass.
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Unraid 6.8.0 - Auth Bypass PHP Code Execution (Metasploit)
Unraid through 6.8.0 allows Remote Code Execution.
100RIESGO
abrir ↗GitHub PoC
darren646/CVE-2019-19781POC
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RIESGO
abrir ↗GitHub PoC★ 570
CVE-2020-0796 Remote Code Execution POC
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RIESGO
abrir ↗VulnCheck XDB
initial-access
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RIESGO
abrir ↗GitHub PoC
kristyna-mlcakova/CVE-2018-10933
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RIESGO
abrir ↗VulnCheck XDB
initial-access
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Servi
100RIESGO
abrir ↗GitHub PoC★ 4
Exploit for CVE-2020-3952 in vCenter 6.7 https://www.guardicore.com/2020/04/pwning-vmware-vcenter-cve-2020-3952/
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Servi
100RIESGO
abrir ↗GitHub PoC★ 1
D-LINK ROUTER "MODEL NO: DIR-615" with "FIRMWARE VERSION:20.10" & "HARDWARE VERSION:T1
The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and
23RIESGO
abrir ↗Exploit-DB
Cisco IP Phone 11.7 - Denial of service (PoC)
Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Nexus Repository Manager - Java EL Injection RCE (Metasploit)
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Servi
100RIESGO
abrir ↗Metasploit0
Kibana Upgrade Assistant Telemetry Collector Prototype Pollution
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authen
23RIESGO
abrir ↗Metasploit300
SpamTitan Unauthenticated RCE
An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp
60RIESGO
abrir ↗GitHub PoC★ 2
VMWare vmdir missing access control exploit checker
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Servi
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
PlaySMS - index.php Unauthenticated Template Injection Code Execution (Metasploit)
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware
48RIESGO
abrir ↗GitHub PoC★ 11
CVE-2020-5260演示记录
malicious URLs may cause Git to present stored credentials to the wrong server
48RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Liferay Portal - Java Unmarshalling via JSONWS RCE (Metasploit)
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer
68RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ThinkPHP - Multiple PHP Injection RCEs (Metasploit)
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ThinkPHP - Multiple PHP Injection RCEs (Metasploit)
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DotNetNuke - Cookie Deserialization Remote Code Execution (Metasploit)
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code e
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Apache Solr - Remote Code Execution via Velocity Template (Metasploit)
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Servi
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Arch
68RIESGO
abrir ↗GitHub PoC★ 28
This utility can help determine if indicators of compromise (IOCs) exist in the log files of a Pulse Secure VPN Appliance for CVE-2019-11510.
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthent
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.