Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.989exploits catalogados

40.450CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.042VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

86.989 exploits

Exploit-DB✓ VexDay Proof

Linux - Missing Locking Between ELF coredump code and userfaultfd VMA Modification

CVE-2019-11599—doslinux30 abr 2019

The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma la

23RIESGO

abrir ↗

Exploit-DB

Moodle 3.6.3 - 'Install Plugin' Remote Command Execution (Metasploit)

CVE-2019-11631—remotephp30 abr 2019

35RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2018-1273CRITICALbajo ataqueransomware29 abr 2019

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property

100RIESGO

abrir ↗

GitHub PoC★ 58

Spring Data Commons RCE 远程命令执行漏洞

CVE-2018-1273CRITICALbajo ataqueransomware29 abr 2019

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property

100RIESGO

abrir ↗

Metasploit600

GetSimpleCMS Unauthenticated RCE

CVE-2019-11231—28 abr 2019

An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows

60RIESGO

abrir ↗

Metasploit600

Moodle Admin Shell Upload

CVE-2019-11631—28 abr 2019

35RIESGO

abrir ↗

GitHub PoC

Confluence Widget Connector path traversal (CVE-2019-3396)

CVE-2019-3396CRITICALbajo ataqueransomware28 abr 2019

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers

100RIESGO

abrir ↗

GitHub PoC

An intentionally vulnerable (CVE-2017-8046) SrpingData REST appl with Swagger Support for pentesting purposes

CVE-2017-8046—27 abr 2019

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions pri

60RIESGO

abrir ↗

GitHub PoC

shawntns/exploit-CVE-2014-6271

CVE-2014-6271CRITICALbajo ataque27 abr 2019

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2014-6271CRITICALbajo ataque27 abr 2019

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process

CVE-2019-3843MEDIUMdoslinux26 abr 2019

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo

33RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process

CVE-2019-3844MEDIUMdoslinux26 abr 2019

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of

33RIESGO

abrir ↗

Exploit-DB

Apache Pluto 3.0.0 / 3.0.1 - Persistent Cross-Site Scripting

CVE-2019-0186—webappsjava26 abr 2019

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XS

28RIESGO

abrir ↗

Exploit-DB

JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scripting

CVE-2019-7438—webappshardware25 abr 2019

cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter.

23RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

RARLAB WinRAR 5.61 - ACE Format Input Validation Remote Code Execution (Metasploit)

CVE-2018-20250HIGHbajo ataqueransomwarelocalwindows25 abr 2019

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RIESGO

abrir ↗

GitHub PoC★ 105

CVE-2019-2725poc汇总更新绕过CVE-2017-10271补丁POC

CVE-2017-10271HIGHbajo ataqueransomware25 abr 2019

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RIESGO

abrir ↗

GitHub PoC★ 105

CVE-2019-2725poc汇总更新绕过CVE-2017-10271补丁POC

CVE-2019-2725HIGHbajo ataqueransomware25 abr 2019

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte

100RIESGO

abrir ↗

Exploit-DB

JioFi 4G M2S 1.0.2 - Denial of Service

CVE-2019-7439—doshardware25 abr 2019

cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.

23RIESGO

abrir ↗

GitHub PoC★ 115

WebLogic CNVD-C-2019_48814 CVE-2017-10271 Scan By 7kbstorm

CVE-2017-10271HIGHbajo ataqueransomware25 abr 2019

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RIESGO

abrir ↗

VulnCheck XDB

client-side

CVE-2018-20250HIGHbajo ataqueransomware25 abr 2019

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2017-10271HIGHbajo ataqueransomware25 abr 2019

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RIESGO

abrir ↗

GitHub PoC★ 1

WebLogic CNVD-C-2019_48814 CVE-2017-10271

CVE-2017-10271HIGHbajo ataqueransomware25 abr 2019

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RIESGO

abrir ↗

GitHub PoC★ 9

The official exploit code for LibreNMS v1.46 Remote Code Execution CVE-2018-20434

CVE-2018-20434—25 abr 2019

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to htm

60RIESGO

abrir ↗

GitHub PoC

likekabin/CVE-2018-20250

CVE-2018-20250HIGHbajo ataqueransomware25 abr 2019

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

VirtualBox 6.0.4 r128413 - COM RPC Interface Code Injection Host Privilege Escalation

CVE-2019-2721—localwindows24 abr 2019

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th

23RIESGO

abrir ↗

GitHub PoC

KeyStrOke95/nfsen_1.3.7_CVE-2017-6971

CVE-2017-6971—24 abr 2019

AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary comma

28RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2019-1003000—24 abr 2019

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/

60RIESGO

abrir ↗

Metasploit300

Pulse Secure VPN Arbitrary File Disclosure

CVE-2019-11510CRITICALbajo ataqueransomware24 abr 2019

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthent

100RIESGO

abrir ↗

Metasploit600

Pulse Secure VPN Arbitrary Command Execution

CVE-2019-11539HIGHbajo ataqueransomware24 abr 2019

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R

100RIESGO

abrir ↗

Metasploit600

WP Database Backup RCE

CVE-2019-25224CRITICAL24 abr 2019

WP Database Backup < 5.2 - Unauthenticated OS Command Injection

68RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.