Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

86.991exploits catalogados

40.452CVEs con explotación pública

24.696probados en laboratorio

Todos Referência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientes populares riesgo

86.991 exploits

Exploit-DB✓ VexDay Proof

Jenkins 2.137 and Pipeline Groovy Plugin 2.61 - ACL Bypass and Metaprogramming Remote Code Execution (Metasploit)

CVE-2019-1003000—remotejava19 mar 2019

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/

60RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

Google Chrome < M73 - Double-Destruction Race in StoragePartitionService

CVE-2019-5797HIGHdosmultiple19 mar 2019

Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap c

41RIESGO

abrir ↗

GitHub PoC★ 36

A multi-threaded Golang scanner to identify Ruby endpoints vulnerable to CVE-2019-5418

CVE-2019-5418HIGHbajo ataque19 mar 2019

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe

100RIESGO

abrir ↗

GitHub PoC★ 5

File Content Disclosure on Rails Test Case - CVE-2019-5418

CVE-2019-5418HIGHbajo ataque18 mar 2019

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe

100RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

BMC Patrol Agent - Privilege Escalation Code Execution Execution (Metasploit)

CVE-2018-20735—remotemultiple18 mar 2019

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for l

38RIESGO

abrir ↗

GitHub PoC★ 7

xConsoIe/CVE-2019-0193

CVE-2019-0193HIGHbajo ataque18 mar 2019

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources,

100RIESGO

abrir ↗

Metasploit300

IBM BigFix Relay Server Sites and Package Enum

CVE-2019-4061MEDIUM18 mar 2019

IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the upd

33RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2018-20062CRITICALbajo ataque17 mar 2019

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP

100RIESGO

abrir ↗

GitHub PoC★ 6

thinkphp5.*Rce CVE-2018-20062

CVE-2018-20062CRITICALbajo ataque17 mar 2019

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP

100RIESGO

abrir ↗

GitHub PoC★ 201

CVE-2019-5418 - File Content Disclosure on Ruby on Rails

CVE-2019-5418HIGHbajo ataque16 mar 2019

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe

100RIESGO

abrir ↗

VulnCheck XDB

infoleak

CVE-2019-5418HIGHbajo ataque16 mar 2019

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe

100RIESGO

abrir ↗

GitHub PoC★ 1

原创作者：Bearcat@secfree.com

CVE-2017-10271HIGHbajo ataqueransomware15 mar 2019

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RIESGO

abrir ↗

Exploit-DB

Moodle 3.4.1 - Remote Code Execution

CVE-2018-1133—webappsphp15 mar 2019

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code exec

35RIESGO

abrir ↗

Exploit-DB

Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities

CVE-2014-10078—webappsphp15 mar 2019

Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfa

23RIESGO

abrir ↗

GitHub PoC

cve-2019-9184

CVE-2019-9184—15 mar 2019

SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitr

23RIESGO

abrir ↗

GitHub PoC★ 10

Noodle [Moodle RCE] (v3.4.1) - CVE-2018-1133

CVE-2018-1133—15 mar 2019

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code exec

35RIESGO

abrir ↗

GitHub PoC

cve-2018-16283

CVE-2018-16283—15 mar 2019

The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.

50RIESGO

abrir ↗

GitHub PoC

The exploit python script for CVE-2018-7600

CVE-2018-7600CRITICALbajo ataqueransomware15 mar 2019

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

CMS Made Simple Showtime2 Module 3.6.2 - (Authenticated) Arbitrary File Upload

CVE-2019-9692—webappsphp15 mar 2019

class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard

50RIESGO

abrir ↗

GitHub PoC

cve-2019-9194

CVE-2019-9194—15 mar 2019

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

60RIESGO

abrir ↗

Exploit-DB

Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities

CVE-2014-10079—webappsphp15 mar 2019

In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hid

23RIESGO

abrir ↗

VulnCheck XDB

initial-access

CVE-2017-10271HIGHbajo ataqueransomware15 mar 2019

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RIESGO

abrir ↗

VulnCheck XDB

client-side

CVE-2018-20250HIGHbajo ataqueransomware15 mar 2019

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RIESGO

abrir ↗

Exploit-DB

FTPGetter Standard 5.97.0.177 - Remote Code Execution

CVE-2019-9760—remotewindows14 mar 2019

FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-cont

50RIESGO

abrir ↗

Exploit-DB

WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion

CVE-2019-9618—webappsphp13 mar 2019

The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.

50RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

elFinder PHP Connector < 2.1.48 - 'exiftran' Command Injection (Metasploit)

CVE-2019-9194—remotephp13 mar 2019

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

60RIESGO

abrir ↗

Exploit-DB✓ VexDay Proof

Apache Tika-server < 1.18 - Command Injection

CVE-2018-1335—remotewindows13 mar 2019

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to

60RIESGO

abrir ↗

Metasploit600

Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF

CVE-2019-9670CRITICALbajo ataque13 mar 2019

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XX

100RIESGO

abrir ↗

Metasploit600

Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF

CVE-2019-9621HIGHbajo ataque13 mar 2019

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x b

100RIESGO

abrir ↗

Metasploit600

Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability

CVE-2019-5420—13 mar 2019

A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess th

60RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.