Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.634exploits catalogados

40.286CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.110Exploit-DB 24.488GitHub PoC 17.941VulnCheck XDB 10.016Nuclei 4547Metasploit 3532✓ solo verificadosrecientes populares riesgo

86.634 exploits

VulnCheck XDB

client-side

CVE-2017-11882HIGHbajo ataqueransomware02 ene 2020

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RIESGO

VulnCheck XDB

initial-access

CVE-2019-16278CRITICALbajo ataque01 ene 2020

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

100RIESGO

GitHub PoC

CVE-2019-16278：Nostromo Web服务器的RCE漏洞

CVE-2019-16278CRITICALbajo ataque01 ene 2020

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

100RIESGO

Exploit-DB✓ VexDay Proof

nostromo 1.9.6 - Remote Code Execution

CVE-2019-16278CRITICALbajo ataqueremotemultiple01 ene 2020

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

100RIESGO

GitHub PoC★ 1

(Nhttpd) Nostromo 1.9.6 RCE due to Directory Traversal

CVE-2019-16278CRITICALbajo ataque31 dic 2019

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

100RIESGO

VulnCheck XDB

initial-access

CVE-2019-16278CRITICALbajo ataque31 dic 2019

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

100RIESGO

Exploit-DB

Sony Playstation 4 (PS4) < 6.72 - WebKit Code Execution (PoC)

CVE-2018-4386—webappshardware31 dic 2019

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iO

23RIESGO

Exploit-DB✓ VexDay Proof

Microsoft UPnP - Local Privilege Elevation (Metasploit)

CVE-2019-1405HIGHbajo ataqueransomwarelocalwindows30 dic 2019

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows

98RIESGO

Exploit-DB✓ VexDay Proof

Microsoft UPnP - Local Privilege Elevation (Metasploit)

CVE-2019-1322HIGHbajo ataqueransomwarelocalwindows30 dic 2019

An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft W

91RIESGO

Exploit-DB✓ VexDay Proof

OpenBSD - Dynamic Loader chpass Privilege Escalation (Metasploit)

CVE-2019-19726—localopenbsd30 dic 2019

OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be

38RIESGO

Exploit-DB✓ VexDay Proof

FreeBSD-SA-19:02.fd - Privilege Escalation

CVE-2019-5596—localfreebsd30 dic 2019

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEAS

23RIESGO

GitHub PoC

samba 4.5.9

CVE-2017-7494CRITICALbajo ataqueransomware30 dic 2019

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo

100RIESGO

GitHub PoC★ 4

Identify vulnerable (RCE) vBulletin 5.0.0 - 5.5.4 instances using Shodan (CVE-2019-16759)

CVE-2019-16759CRITICALbajo ataque29 dic 2019

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge

100RIESGO

GitHub PoC

webmin_CVE-2019-15107

CVE-2019-15107CRITICALbajo ataqueransomware29 dic 2019

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RIESGO

VulnCheck XDB

initial-access

CVE-2019-16759CRITICALbajo ataque29 dic 2019

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge

100RIESGO

GitHub PoC

HttpFileServer httpd 2.3

CVE-2014-6287CRITICALbajo ataque27 dic 2019

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RIESGO

GitHub PoC★ 5

CVE-2018-8639-EXP

CVE-2018-8639HIGHbajo ataqueransomware27 dic 2019

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

76RIESGO

VulnCheck XDB

initial-access

CVE-2014-6287CRITICALbajo ataque27 dic 2019

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RIESGO

VulnCheck XDB

local

CVE-2019-10758CRITICALbajo ataque26 dic 2019

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse

100RIESGO

GitHub PoC★ 111

masahiro331/CVE-2019-10758

CVE-2019-10758CRITICALbajo ataque26 dic 2019

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse

100RIESGO

GitHub PoC★ 78

Apache Log4j 1.2.X存在反序列化远程代码执行漏洞

CVE-2019-17571CRITICAL25 dic 2019

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be explo

60RIESGO

GitHub PoC★ 8

poc exploit for webmin backdoor (CVE-2019-15107 and CVE-2019-15231)

CVE-2019-15107CRITICALbajo ataqueransomware25 dic 2019

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RIESGO

GitHub PoC★ 8

PoC for CVE-2019-19844 ( https://www.djangoproject.com/weblog/2019/dec/18/security-releases/ )

CVE-2019-19844—25 dic 2019

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address

35RIESGO

VulnCheck XDB

infoleak

CVE-2019-15107CRITICALbajo ataqueransomware25 dic 2019

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RIESGO

Exploit-DB✓ VexDay Proof

Django < 3.0 < 2.2 < 1.11 - Account Hijack

CVE-2019-19844—webappspython24 dic 2019

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address

35RIESGO

Metasploit600

D-Link DIR-859 Unauthenticated Remote Command Execution

CVE-2019-17621CRITICALbajo ataque24 dic 2019

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated rem

100RIESGO

Metasploit600

D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi

CVE-2019-20215—24 dic 2019

D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the

60RIESGO

GitHub PoC★ 3

CVE-2018-6389: WordPress <= 4.9.x 拒绝服务(DOS)漏洞

CVE-2018-6389—22 dic 2019

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the

45RIESGO

VulnCheck XDB

client-side

CVE-2017-11882HIGHbajo ataqueransomware21 dic 2019

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RIESGO

GitHub PoC★ 641

一款功能强大的漏洞扫描器，子域名爆破使用aioDNS，asyncio异步快速扫描，覆盖目标全方位资产进行批量漏洞扫描，中间件信息收集，自动收集ip代理，探测Waf信息时自动使用来保护本机真实Ip，在本机Ip被Waf杀死后，自动切换代理Ip进行扫描，Waf信息收集(国内外100+款waf信息)包括安全狗，云锁，阿里云，云盾，腾讯云等，提供部分已知waf bypass 方案，中间件漏洞检测(Thinkphp,weblogic等 CVE-2018-5955,CVE-2018-12613,CVE-2018-11759等)，支持SQL注入, XSS, 命令执行,文件包含, ssrf 漏洞扫描, 支持自定义漏洞邮箱推送功能

CVE-2018-5955—21 dic 2019

An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unau

60RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.