Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
80.095exploits catalogados
36.945CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.476Referência 23.442GitHub PoC 15.312VulnCheck XDB 8970Nuclei 4393Metasploit 3502✓ solo verificadosrecientespopularesriesgo
80.095 exploits
Exploit-DB
Check_MK 1.2.8p25 - Information Disclosure
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, whi
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Xen - Pagetable De-typing Unbounded Recursion
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recu
23RIESGO
abrir ↗Exploit-DB
OpenText Documentum Content Server - Arbitrary File Download Privilege Escalation
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 does not properly validate the i
23RIESGO
abrir ↗Exploit-DB
OpenText Documentum Content Server - Arbitrary File Download
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design ga
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Apple iOS 10.2 (14C92) - Remote Code Execution
An issue was discovered in certain Apple products. iOS before 11 is affected. tvOS before 11 is affected. The issue invo
23RIESGO
abrir ↗Exploit-DB
TP-Link WR940N - (Authenticated) Remote Code
Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 11 (Windows 7 x86) - 'mshtml.dll' Remote Code Execution (MS17-007)
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilde
93RIESGO
abrir ↗Exploit-DB
Linux Kernel - 'AF_PACKET' Use-After-Free (2)
net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'nt!NtQueryObject (ObjectNameInformation)' Kernel Pool Memory Disclosure
The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Wind
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Apache Solr 7.0.1 - XML External Entity Expansion / Remote Code Execution
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction wi
60RIESGO
abrir ↗Exploit-DB
OpenText Documentum Content Server - 'dmr_content' Privilege Escalation
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design ga
23RIESGO
abrir ↗Exploit-DB
OpenText Documentum Content Server - Privilege Escalation
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design ga
23RIESGO
abrir ↗GitHub PoC
A simple python shell-like exploit for the Shellschok CVE-2014-6271 bug.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'StackScriptFunction::BoxState::Box' Accesses to Uninitialized Pointers (Denial of Service)
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit)
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - Incorrect GenerateBailOut Calling Patterns
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker
35RIESGO
abrir ↗VulnCheck XDB
initial-access
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Windows 10 - WLDP/MSHTML CLSID UMCI Bypass
The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - 'RegexHelper::StringReplace' Must Call the Callback Function with Updating ImplicitCallFlags
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker
35RIESGO
abrir ↗GitHub PoC
PHPMailer < 5.2.18 Remote Code Execution
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 11 (Windows 7 x86) - 'mshtml.dll' Remote Code Execution (MS17-007)
Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via
75RIESGO
abrir ↗Exploit-DB
Linux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation
Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges o
23RIESGO
abrir ↗Exploit-DB
3CX Phone System 15.5.3554.1 - Directory Traversal
In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory t
23RIESGO
abrir ↗Exploit-DB
Ikraus Anti Virus 2.16.7 - Remote Code Execution
An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKA
23RIESGO
abrir ↗Exploit-DB
Webmin 1.850 - Multiple Vulnerabilities
SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/h
23RIESGO
abrir ↗Exploit-DB
Webmin 1.850 - Multiple Vulnerabilities
CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker
23RIESGO
abrir ↗Exploit-DB
Webmin 1.850 - Multiple Vulnerabilities
Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Down
23RIESGO
abrir ↗Exploit-DB
Logitech Media Server - Cross-Site Scripting
DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1
23RIESGO
abrir ↗Exploit-DB
phpMyFAQ 2.9.8 - Cross-Site Scripting (2)
Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web scrip
23RIESGO
abrir ↗Exploit-DB
AlienVault Unified Security Management (USM) 5.4.2 - Cross-Site Request Forgery
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/
23RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.