Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.899exploits catalogados
40.392CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.190Exploit-DB 24.488GitHub PoC 18.020VulnCheck XDB 10.108Nuclei 4556Metasploit 3537✓ solo verificadosrecientespopularesriesgo
86.899 exploits
GitHub PoC
webcam bug (python)
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L
60RIESGO
abrir ↗GitHub PoC★ 4
CVE-2019-10149
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
AwindInc SNMP Service - Command Injection (Metasploit)
Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote
60RIESGO
abrir ↗Exploit-DB
WordPress Plugin Download Manager 2.9.93 - Cross-Site Scripting
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by t
53RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R
100RIESGO
abrir ↗Metasploit300
Metasploit HTTP(S) handler DoS
Rapid7 Metasploit HTTP Handler Denial of Service
48RIESGO
abrir ↗GitHub PoC★ 132
Exploit for the Post-Auth RCE vulnerability in Pulse Secure Connect
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R
100RIESGO
abrir ↗Exploit-DB
DASAN Zhone ZNID GPON 2426A EU - Multiple Cross-Site Scripting
Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devic
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
ktsuss 1.4 - suid Privilege Escalation (Metasploit)
ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified com
60RIESGO
abrir ↗GitHub PoC★ 1
jaychouzzk/CVE-2019-0193-exp
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources,
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco RV110W/RV130(W)/RV215W Routers Management Interface - Remote Command Execution (Metasploit)
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RIESGO
abrir ↗VulnCheck XDB
initial-access
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources,
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5
60RIESGO
abrir ↗VulnCheck XDB
initial-access
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco Data Center Network Manager - Unauthenticated Remote Code Execution (Metasploit)
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco UCS Director - default scpuser password (Metasploit)
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability
85RIESGO
abrir ↗GitHub PoC★ 2
CVE-2019-0708 BlueKeep漏洞批量扫描工具和POC，暂时只有蓝屏。
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco Data Center Network Manager - Unauthenticated Remote Code Execution (Metasploit)
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Cisco Data Center Network Manager - Unauthenticated Remote Code Execution (Metasploit)
Cisco Data Center Network Manager Information Disclosure Vulnerability
70RIESGO
abrir ↗GitHub PoC
A script to Fuzz and and exploit Apache struts CVE-2017-9805
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RIESGO
abrir ↗Exploit-DB
Opencart 3.x - Cross-Site Scripting
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing fe
23RIESGO
abrir ↗Exploit-DB
Alkacon OpenCMS 10.5.x - Cross-Site Scripting
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
23RIESGO
abrir ↗VulnCheck XDB
initial-access
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RIESGO
abrir ↗Exploit-DB
Alkacon OpenCMS 10.5.x - Cross-Site Scripting (2)
In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the man
23RIESGO
abrir ↗Exploit-DB
Craft CMS 2.7.9/3.2.5 - Information Disclosure
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images whe
23RIESGO
abrir ↗Exploit-DB
Alkacon OpenCMS 10.5.x - Cross-Site Scripting
In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
23RIESGO
abrir ↗Exploit-DB
Alkacon OpenCMS 10.5.x - Local File inclusion
In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an atta
23RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise
50RIESGO
abrir ↗GitHub PoC
simplified version of https://github.com/shauntdergrigorian/cve-2006-6184
Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote at
50RIESGO
abrir ↗VulnCheck XDB
infoleak
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.