Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

80.184exploits catalogados

37.029CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.476Referência 23.521GitHub PoC 15.321VulnCheck XDB 8970Nuclei 4394Metasploit 3502✓ solo verificadosrecientes populares riesgo

80.184 exploits

Exploit-DB

Nitro Pro PDF - Multiple Vulnerabilities

CVE-2017-7950—localwindows24 jul 2017

Nitro Pro 11.0.3 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted PCX

23RIESGO

Exploit-DB

Linux Kernel - 'BadIRET' Local Privilege Escalation

CVE-2014-9322—locallinux24 jul 2017

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack S

23RIESGO

Exploit-DB✓ VexDay Proof

Razer Synapse 2.20.15.1104 - rzpnk.sys ZwOpenProcess (Metasploit)

CVE-2017-9769—localwindows_x86-6424 jul 2017

A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpe

60RIESGO

Exploit-DB✓ VexDay Proof

WebKit - 'WebCore::AccessibilityRenderObject::handleAriaExpandedChanged' Use-After-Free

CVE-2017-7043—dosmultiple24 jul 2017

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo

23RIESGO

Metasploit600

Nitro Pro PDF Reader 11.0.3.173 Javascript API Remote Code Execution

CVE-2017-7442—24 jul 2017

Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory tra

50RIESGO

GitHub PoC★ 66

ppsx file generator for cve-2017-8570 (based on bhdresh/cve-2017-8570)

CVE-2017-8570HIGHbajo ataque24 jul 2017

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic

93RIESGO

Exploit-DB

vBulletin 5.1.2 < 5.1.9 - Unserialize Code Execution (Metasploit)

CVE-2015-7808—webappsphp24 jul 2017

The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PH

60RIESGO

GitHub PoC★ 1

liusec/WP-CVE-2016-10033

CVE-2016-10033CRITICALbajo ataque22 jul 2017

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RIESGO

Metasploit600

DotNetNuke Cookie Deserialization Remote Code Excecution

CVE-2017-9822HIGHbajo ataqueransomware20 jul 2017

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code e

100RIESGO

Metasploit600

DotNetNuke Cookie Deserialization Remote Code Excecution

CVE-2018-15811HIGHbajo ataque20 jul 2017

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

100RIESGO

Metasploit600

DotNetNuke Cookie Deserialization Remote Code Excecution

CVE-2018-18325HIGHbajo ataque20 jul 2017

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue ex

100RIESGO

Metasploit600

DotNetNuke Cookie Deserialization Remote Code Excecution

CVE-2018-15812—20 jul 2017

DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expect

50RIESGO

Metasploit600

DotNetNuke Cookie Deserialization Remote Code Excecution

CVE-2018-18326—20 jul 2017

DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expect

50RIESGO

Metasploit600

Supervisor XML-RPC Authenticated Remote Code Execution

CVE-2017-11610—19 jul 2017

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows rem

60RIESGO

Exploit-DB

Citrix CloudBridge - 'CAKEPHP' Cookie Command Injection

CVE-2017-6316CRITICALbajo ataquewebappscgi19 jul 2017

Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as r

100RIESGO

GitHub PoC★ 8

CVE-2014-9322 (a.k.a BadIRET) proof of concept for Linux

CVE-2014-9322—19 jul 2017

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack S

23RIESGO

Exploit-DB

Netscaler SD-WAN 9.1.2.26.561201 - Command Injection (Metasploit)

CVE-2017-6316CRITICALbajo ataquewebappscgi19 jul 2017

Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as r

100RIESGO

Exploit-DB

Sonicwall Secure Remote Access 8.1.0.2-14sv - Command Injection

CVE-2016-9682—webappscgi19 jul 2017

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabi

28RIESGO

Exploit-DB

Oracle E-Business Suite 12.x - Server-Side Request Forgery

CVE-2017-10246—webappsjsp19 jul 2017

Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Suppo

28RIESGO

Exploit-DB✓ VexDay Proof

Microsoft Windows Kernel - 'IOCTL 0x120007 NsiGetParameter' nsiproxy/netio Pool Memory Disclosure

CVE-2017-8564—doswindows18 jul 2017

Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and

23RIESGO

Exploit-DB

PEGA Platform <= 7.2 ML0 - Missing Access Control / Cross-Site Scripting

CVE-2017-11355—webappsmultiple18 jul 2017

Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to injec

23RIESGO

Exploit-DB✓ VexDay Proof

Microsoft Internet Explorer 11.1066.14393.0 - VBScript Arithmetic Functions Type Confusion

CVE-2017-8618—doswindows18 jul 2017

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server

35RIESGO

Exploit-DB

Barracuda Load Balancer Firmware < 6.0.1.006 - Remote Command Injection (Metasploit)

CVE-2017-6320—webappshardware18 jul 2017

A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (20

28RIESGO

Exploit-DB✓ VexDay Proof

Sophos Web Appliance 4.3.0.2 - 'trafficType' Remote Command Injection (Metasploit)

CVE-2017-6182—webappsjson18 jul 2017

In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports wa

28RIESGO

Exploit-DB

Hashicorp vagrant-vmware-fusion < 4.0.20 - Local Privilege Escalation

CVE-2017-7642—localmacos18 jul 2017

The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local use

23RIESGO

Exploit-DB

PEGA Platform <= 7.2 ML0 - Missing Access Control / Cross-Site Scripting

CVE-2017-11356—webappsmultiple18 jul 2017

The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users

23RIESGO

Exploit-DB✓ VexDay Proof

Microsoft Internet Explorer 11.0.9600.18617 - 'CMarkup::DestroySplayTree' Memory Corruption

CVE-2017-8594—doswindows18 jul 2017

Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute

35RIESGO

GitHub PoC★ 339

An internet scanner for exploit CVE-2017-0144 (Eternal Blue) & CVE-2017-0145 (Eternal Romance)

CVE-2017-0144HIGHbajo ataqueransomware16 jul 2017

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RIESGO

Exploit-DB

Geneko Routers - Path Traversal

CVE-2017-11456—webappshardware16 jul 2017

Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticate

23RIESGO

Exploit-DB

Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution

CVE-2017-5375—remotewindows14 jul 2017

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. T

35RIESGO

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.