Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.886exploits catalogados

32.153CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8176Nuclei 4202Metasploit 3462✓ solo verificadosrecientes populares riesgo

4202 exploits

Nucleimedium

Fortinet FortiOS <=5.2.3 - Cross-Site Scripting

CVE-2015-1880—

Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a

23RIESGO

abrir ↗

Nucleihigh

WP Attachment Export < 0.2.4 - Unrestricted File Download

CVE-2015-20067—

WP Attachment Export < 0.2.4 - Unauthenticated Posts Download

18RIESGO

abrir ↗

Nucleimedium

Magento Server MAGMI - Directory Traversal

CVE-2015-2067—

Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento

50RIESGO

abrir ↗

Nucleimedium

Magento Server Mass Importer - Cross-Site Scripting

CVE-2015-2068—

Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server a

43RIESGO

abrir ↗

Nucleihigh

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

CVE-2015-2080—

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive informat

60RIESGO

abrir ↗

Nucleimedium

Ericsson Drutt MSDP - Local File Inclusion

CVE-2015-2166—

Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5

43RIESGO

abrir ↗

Nucleihigh

WordPress Spider Calendar <=1.4.9 - SQL Injection

CVE-2015-2196—

SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQ

43RIESGO

abrir ↗

Nucleimedium

WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting

CVE-2015-2755—

Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for Wo

18RIESGO

abrir ↗

Nucleicritical

DotNetNuke 07.04.00 - Administration Authentication Bypass

CVE-2015-2794—

The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain S

60RIESGO

abrir ↗

Nucleimedium

Navis DocumentCloud <0.1.1 - Cross-Site Scripting

CVE-2015-2807—

Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress a

18RIESGO

abrir ↗

Nucleimedium

Kaseya Virtual System Administrator - Open Redirect

CVE-2015-2863—

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b

43RIESGO

abrir ↗

Nucleihigh

SysAid Help Desk <15.2 - Local File Inclusion

CVE-2015-2996—

Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrar

60RIESGO

abrir ↗

Nucleihigh

TP-LINK - Local File Inclusion

CVE-2015-3035HIGHbajo ataque

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before

100RIESGO

abrir ↗

Nucleimedium

Ruby on Rails Web Console - Remote Code Execution

CVE-2015-3224—

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-

50RIESGO

abrir ↗

Nucleimedium

Elasticsearch - Local File Inclusion

CVE-2015-3337—

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a

50RIESGO

abrir ↗

Nucleihigh

ResourceSpace - Local File inclusion

CVE-2015-3648—

Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote atta

18RIESGO

abrir ↗

Nucleimedium

Bonita BPM Portal <6.5.3 - Local File Inclusion

CVE-2015-3897—

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via

43RIESGO

abrir ↗

Nucleimedium

Symfony - Authentication Bypass

CVE-2015-4050—

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.1

18RIESGO

abrir ↗

Nucleimedium

WordPress NewStatPress 0.9.8 - SQL Injection

CVE-2015-4062—

SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remo

38RIESGO

abrir ↗

Nucleilow

NewStatPress <0.9.9 - Cross-Site Scripting

CVE-2015-4063—

Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPres

38RIESGO

abrir ↗

Nucleihigh

Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion

CVE-2015-4074—

Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read ar

50RIESGO

abrir ↗

Nucleimedium

WordPress Church Admin <0.810 - Cross-Site Scripting

CVE-2015-4127—

Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers t

38RIESGO

abrir ↗

Nucleimedium

WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal

CVE-2015-4414—

Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player)

43RIESGO

abrir ↗

Nucleicritical

Rubedo CMS <=3.4.0 - Directory Traversal

CVE-2018-16836—

Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attac

50RIESGO

abrir ↗

Nucleimedium

Monstra CMS 3.0.4 - HTTP Header Injection

CVE-2018-16979—

Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related i

18RIESGO

abrir ↗

Nucleimedium

Apache2 - Transfer-Encoding Chunked XSS

CVE-2018-17082—

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS

18RIESGO

abrir ↗

Nucleicritical

Western Digital MyCloud NAS - Authentication Bypass

CVE-2018-17153—

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulne

40RIESGO

abrir ↗

Nucleicritical

LG Supersign EZ CMS - Remote Code Execution

CVE-2018-17173—

LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getT

50RIESGO

abrir ↗

Nucleicritical

WordPress Duplicator Plugin < 1.2.42 - Arbitrary Code Execution

CVE-2018-17207—

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and

30RIESGO

abrir ↗

Nucleicritical

Kibana - Local File Inclusion

CVE-2018-17246—

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with

60RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.