Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
79.107exploits catalogados
36.322CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8846Nuclei 4361Metasploit 3490✓ solo verificadosrecientespopularesriesgo
24.695 exploits
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - COALineDashStyleArray Unsafe Memory Access (MS12-022) (Metasploit)
Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML obj
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Apache Roller - OGNL Injection (Metasploit)
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - COALineDashStyleArray Unsafe Memory Access (MS12-022) (Metasploit)
Untrusted search path vulnerability in Microsoft Expression Design; Expression Design SP1; and Expression Design 2, 3, a
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - CardSpaceClaimCollection ActiveX Integer Underflow (MS13-090) (Metasploit)
The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DesktopCentral AgentLogUpload - Arbitrary File Upload (Metasploit)
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Netgear ReadyNAS - Perl Code Evaluation (Metasploit)
Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DesktopCentral AgentLogUpload - Arbitrary File Upload (Metasploit)
Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before buil
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
MyBB Ajaxfs 2 Plugin - SQL Injection
Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletin
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Blue Wrench Video Widget - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin be
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Light Alloy 4.7.3 - '.m3u' Local Buffer Overflow (SEH Unicode)
Stack-based buffer overflow in Vortex Light Alloy before 4.7.4 allows remote attackers to execute arbitrary code via a l
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Thomson Reuters Velocity Analytics - Remote Code Injection
VhttpdMgr in Thomson Reuters Velocity Analytics Vhayu Analytic Server 6.94 build 2995 allows remote attackers to execute
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
PineApp MailSecure - Remote Command Execution
admin/confnetworking.html in PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms allows remote attacker
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
PineApp MailSecure - Remote Command Execution
admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacha
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
PineApp MailSecure - Remote Command Execution
PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms has a sudoers file that does not properly restrict
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
DeepOfix SMTP Server 3.3 - Authentication Bypass
The SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via an empty password, whic
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Nginx 1.1.17 - URI Processing SecURIty Bypass
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
35RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Supermicro Onboard IPMI - 'close_window.cgi' Remote Buffer Overflow (Metasploit)
Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Managemen
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Watermark Master 2.2.23 - '.wstyle' Local Buffer Overflow (SEH)
Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Symantec Altiris DS - SQL Injection (Metasploit)
SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allow
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Testa OTMS - Multiple SQL Injections
SQL injection vulnerability in Testa Online Test Management System (OTMS) 2.0.0.2 allows remote attackers to execute arb
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Vanilla Forums 2.0 < 2.0.18.5 - 'class.utilitycontroller.php' PHP Object Injection
Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Vivotek IP Cameras - RTSP Authentication Bypass
Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Vanilla Forums 2.0 < 2.0.18.5 - 'class.utilitycontroller.php' PHP Object Injection
20RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Horde Groupware Web Mail Edition 5.1.2 - Cross-Site Request Forgery (2)
Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
VICIdial Manager - Send OS Command Injection (Metasploit)
VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execut
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
VICIdial Manager - Send OS Command Injection (Metasploit)
Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-40
50RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
VICIdial Manager - Send OS Command Injection (Metasploit)
VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded password of donotedit for t
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Hanso Player 2.5.0 - 'm3u' Buffer Overflow (Denial of Service)
Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of servic
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Google Android - Signature Verification Security Bypass
Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Watermark Master 2.2.23 - Local Buffer Overflow (SEH)
Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a
50RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.