Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.989exploits catalogados
40.450CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.042VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
86.989 exploits
GitHub PoC★ 78
Zimbra邮件系统漏洞 XXE/RCE/SSRF/Upload GetShell Exploit 1. (CVE-2019-9621 Zimbra<8.8.11 XXE GetShell Exploit)
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x b
100RIESGO
abrir ↗GitHub PoC★ 2
leerina/CVE-2019-2725
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RIESGO
abrir ↗VulnCheck XDB
initial-access
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RIESGO
abrir ↗GitHub PoC★ 227
Exploit for CVE-2019-9810 Firefox on Windows 64-bit.
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check
28RIESGO
abrir ↗VulnCheck XDB
client-side
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check
28RIESGO
abrir ↗Exploit-DB
SolarWinds DameWare Mini Remote Control 10.0 - Denial of Service
DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the m
28RIESGO
abrir ↗Exploit-DB
WordPress Plugin Social Warfare < 3.5.3 - Remote Code Execution
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio
100RIESGO
abrir ↗Exploit-DB
Crestron AM/Barco wePresent WiPG/Extron ShareLink/Teq AV IT/SHARP PN-L703WA/Optoma WPS-Pro/Blackbox HD WPS/InFocus LiteShow - Remote Command Injection
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RIESGO
abrir ↗VulnCheck XDB
initial-access
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio
100RIESGO
abrir ↗GitHub PoC★ 22
CVE-2019-9978 - (PoC) RCE in Social WarFare Plugin (<=3.5.2)
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio
100RIESGO
abrir ↗Exploit-DB
Zotonic < 0.47.0 mod_admin - Cross-Site Scripting
Zotonic before version 0.47 has mod_admin XSS.
23RIESGO
abrir ↗GitHub PoC★ 2
A proof of concept for ReadyAPI 2.5.0/2.6.0 Remote Code Execution Vulnerability.
The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java co
23RIESGO
abrir ↗GitHub PoC★ 1
davidmthomsen/CVE-2019-2725
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RIESGO
abrir ↗VulnCheck XDB
remote-with-credentials
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry ca
60RIESGO
abrir ↗GitHub PoC★ 4
WordPress crop-image exploitation
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry ca
60RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution (Metasploit)
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess th
60RIESGO
abrir ↗GitHub PoC★ 21
lasensio/cve-2019-2725
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RIESGO
abrir ↗Exploit-DB
CentOS Web Panel 0.9.8.793 (Free) / v0.9.8.753 (Pro) / 0.9.8.807 (Pro) - Domain Field (Add DNS Zone) Cross-Site Scripting
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro)
23RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Linux - Missing Locking Between ELF coredump code and userfaultfd VMA Modification
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma la
23RIESGO
abrir ↗GitHub PoC★ 1
PoC command injection example for cve-2018-1002105 based off https://github.com/gravitational/cve-2018-1002105
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg
70RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Domoticz 4.10577 - Unauthenticated Remote Command Execution
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
23RIESGO
abrir ↗Exploit-DB
Intelbras IWR 3000N 1.5.0 - Cross-Site Request Forgery
A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstr
23RIESGO
abrir ↗Exploit-DB
HumHub 1.3.12 - Cross-Site Scripting
A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HT
23RIESGO
abrir ↗Metasploit600
Barco WePresent file_transfer.cgi Command Injection
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
AIS logistics ESEL-Server - Unauthenticated SQL Injection Remote Code Execution (Metasploit)
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app)
50RIESGO
abrir ↗Exploit-DB
Spring Cloud Config 2.1.x - Path Traversal (Metasploit)
Directory Traversal with spring-cloud-config-server
60RIESGO
abrir ↗Exploit-DB
Intelbras IWR 3000N - Denial of Service (Remote Reboot)
An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. A malformed login request allows remote attackers to cause
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Domoticz 4.10577 - Unauthenticated Remote Command Execution
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Pimcore < 5.71 - Unserialize Remote Code Execution (Metasploit)
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/c
50RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.