Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
86.991exploits catalogados
40.452CVEs con explotación pública
24.696probados en laboratorio
TodosReferência 26.240Exploit-DB 24.488GitHub PoC 18.044VulnCheck XDB 10.121Nuclei 4561Metasploit 3537✓ solo verificadosrecientespopularesriesgo
86.991 exploits
Exploit-DB
Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution
A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framewor
45RIESGO
abrir ↗GitHub PoC★ 2
CVE-2019-6340 Drupal 8.6.9 REST Auth Bypass examples
Drupal core - Highly critical - Remote Code Execution
100RIESGO
abrir ↗Exploit-DB
Jenkins Plugin Script Security 1.49/Declarative 1.3.4/Groovy 2.60 - Remote Code Execution
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/
60RIESGO
abrir ↗GitHub PoC★ 74
A simple PoC for WordPress RCE (author priviledge), refer to CVE-2019-8942 and CVE-2019-8943.
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry ca
60RIESGO
abrir ↗GitHub PoC★ 153
🐱💻 Poc of CVE-2019-7238 - Nexus Repository Manager 3 Remote Code Execution 🐱💻
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
100RIESGO
abrir ↗VulnCheck XDB
initial-access
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
100RIESGO
abrir ↗Exploit-DB
Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution
Drupal core - Highly critical - Remote Code Execution
100RIESGO
abrir ↗VulnCheck XDB
client-side
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗GitHub PoC★ 42
Environment for CVE-2019-6340 (Drupal)
Drupal core - Highly critical - Remote Code Execution
100RIESGO
abrir ↗GitHub PoC★ 21
Proof of concept code in C# to exploit the WinRAR ACE file extraction path (CVE-2018-20250).
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗Exploit-DB
Teracue ENC-400 - Command Injection / Missing Authentication
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authen
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
WinRAR 5.61 - Path Traversal
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗GitHub PoC★ 30
CVE-2019-6340-Drupal SA-CORE-2019-003
Drupal core - Highly critical - Remote Code Execution
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Nuuo Central Management - (Authenticated) SQL Server SQL Injection (Metasploit)
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can b
50RIESGO
abrir ↗GitHub PoC
nmweizi/CVE-2018-20250-poc-winrar
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Micro Focus Filr 3.4.0.217 - Path Traversal / Local Privilege Escalation
Path traversal vulnerability in Filr web application
33RIESGO
abrir ↗Exploit-DB
Teracue ENC-400 - Command Injection / Missing Authentication
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input direct
28RIESGO
abrir ↗GitHub PoC
A version of the binary patched to address CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗GitHub PoC★ 26
010 Editor template for ACE archive format & CVE-2018-2025[0-3]
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗GitHub PoC★ 493
exp for https://research.checkpoint.com/extracting-code-execution-from-winrar
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
Micro Focus Filr 3.4.0.217 - Path Traversal / Local Privilege Escalation
Local privilege escalation in Filr famtd
41RIESGO
abrir ↗Exploit-DB
WebKit JSC - reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safa
23RIESGO
abrir ↗VulnCheck XDB
client-side
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RIESGO
abrir ↗Exploit-DB
Quest NetVault Backup Server < 11.4.5 - Process Manager Service SQL Injection / Remote Code Execution
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backu
23RIESGO
abrir ↗Exploit-DB
Teracue ENC-400 - Command Injection / Missing Authentication
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the de
28RIESGO
abrir ↗Exploit-DB✓ VexDay Proof
MikroTik RouterOS < 6.43.12 (stable) / < 6.42.12 (long-term) - Firewall and NAT Bypass
MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The so
28RIESGO
abrir ↗GitHub PoC★ 1
CVE-2019-6249 Hucart cms 复现环境
An issue was discovered in HuCart v5.7.4. There is a CSRF vulnerability that can add an admin account via /adminsys/inde
23RIESGO
abrir ↗Metasploit300
Drupal RESTful Web Services unserialize() RCE
Drupal core - Highly critical - Remote Code Execution
100RIESGO
abrir ↗VulnCheck XDB
local
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.