Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.560exploits catalogados
40.285CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.110Exploit-DB 24.488GitHub PoC 17.867VulnCheck XDB 10.016Nuclei 4547Metasploit 3532✓ solo verificadosrecientespopularesriesgo
86.560 exploits
VulnCheck XDB
client-side
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RIESGO
abrir ↗Exploit-DB
BearFTP 0.1.0 - 'PASV' Denial of Service
IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to th
28RIESGO
abrir ↗GitHub PoC★ 1
Resources related to CurveBall (CVE-2020-0601) detection
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RIESGO
abrir ↗Exploit-DB
IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
43RIESGO
abrir ↗Exploit-DB
Cacti 1.2.8 - Authenticated Remote Code Execution
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a
60RIESGO
abrir ↗Exploit-DB
Jira 8.3.4 - Information Disclosure (Username Enumeration)
The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate username
60RIESGO
abrir ↗Exploit-DB
School ERP System 1.0 - Cross Site Request Forgery (Add Admin)
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrati
23RIESGO
abrir ↗Metasploit500
Arista restricted shell escape (with privesc)
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly oth
23RIESGO
abrir ↗VulnCheck XDB
local
AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering
33RIESGO
abrir ↗GitHub PoC
A python implementation of CVE-2004-2271 targeting MiniShare 1.4.1.
Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET req
60RIESGO
abrir ↗GitHub PoC★ 68
CVE-2019-8449 Exploit for Jira v2.1 - v8.3.4
The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate username
60RIESGO
abrir ↗VulnCheck XDB
local
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗GitHub PoC★ 26
Temproot for Bravia TV via CVE-2019-2215.
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RIESGO
abrir ↗GitHub PoC★ 25
Python exploit of cve-2020-7247
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
rConfig 3.9.3 - Authenticated Remote Code Execution
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
OpenSMTPD 6.6.1 - Remote Code Execution
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
100RIESGO
abrir ↗GitHub PoC★ 1
proof of concept for CVE-2020-0601
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RIESGO
abrir ↗Exploit-DB
Cups Easy 1.0 - Cross Site Request Forgery (Password Reset)
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php
23RIESGO
abrir ↗Exploit-DB
Cups Easy 1.0 - Cross Site Request Forgery (Password Reset)
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.
23RIESGO
abrir ↗VulnCheck XDB
client-side
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RIESGO
abrir ↗Exploit-DB
Satellian 1.12 - Remote Code Execution
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to th
60RIESGO
abrir ↗GitHub PoC
ianxtianxt/CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
100RIESGO
abrir ↗GitHub PoC★ 4
TheCyberGeek/CVE-2020-5844
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators t
35RIESGO
abrir ↗Exploit-DB
Microsoft Windows 10 - Theme API 'ThemePack' File Parsing
A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows T
35RIESGO
abrir ↗Exploit-DB
XMLBlueprint 16.191112 - XML External Entity Injection
XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an
23RIESGO
abrir ↗Exploit-DB
Octeth Oempro 4.8 - 'CampaignID' SQL Injection
Octeth Oempro 4.7 and 4.8 allow SQL injection. The parameter CampaignID in Campaign.Get is vulnerable.
23RIESGO
abrir ↗GitHub PoC★ 1
*CVE-2014-6271* Unix Arbitrary Code Execution Exploit commonly know as Shell Shock. Examples, Docs, Incident Response and Vulnerability/Risk Assessment, and Additional Resources may be dumped here. Enjoy :) --- somhmxxghoul ---
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)
Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.
23RIESGO
abrir ↗VulnCheck XDB
client-side
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RIESGO
abrir ↗Metasploit600
OpenSMTPD MAIL FROM Remote Code Execution
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.