Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.886exploits catalogados

32.153CVEs con explotación pública

1932probados en laboratorio

Todos Exploit-DB 22.786Referência 19.978GitHub PoC 13.282VulnCheck XDB 8176Nuclei 4202Metasploit 3462✓ solo verificadosrecientes populares riesgo

4202 exploits

Nucleicritical

IncomCMS 2.0 - Arbitrary File Upload

CVE-2020-29597—

IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows un

60RIESGO

abrir ↗

Nucleicritical

Cisco Adaptive Security Appliance Software/Cisco Firepower Threat Defense - Directory Traversal

CVE-2020-3187CRITICAL

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability

85RIESGO

abrir ↗

Nucleihigh

Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion

CVE-2020-3452HIGHbajo ataque

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

100RIESGO

abrir ↗

Nucleicritical

Cockpit CMS 0.6.1 - Remote Code Execution

CVE-2020-35131—

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCrite

30RIESGO

abrir ↗

Nucleihigh

SMTP WP Plugin Directory Listing

CVE-2020-35234—

The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in De

30RIESGO

abrir ↗

Nucleicritical

Wireless Multiplex Terminal Playout Server <=20.2.8 - Default Credential Detection

CVE-2020-35338—

The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier

23RIESGO

abrir ↗

Nucleicritical

OpenTSDB <=2.4.0 - Remote Code Execution

CVE-2020-35476—

A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. Th

60RIESGO

abrir ↗

Nucleihigh

SearchBlox <9.2.2 - Local File Inclusion

CVE-2020-35580—

A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated us

23RIESGO

abrir ↗

Nucleihigh

Advanced Comment System 1.0 - Local File Inclusion

CVE-2020-35598—

ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=.

43RIESGO

abrir ↗

Nucleicritical

Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution

CVE-2020-35713—

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new passw

50RIESGO

abrir ↗

Nucleicritical

Klog Server <=2.41 - Unauthenticated Command Injection

CVE-2020-35729—

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.

60RIESGO

abrir ↗

Nucleihigh

GateOne 1.1 - Local File Inclusion

CVE-2020-35736—

GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.

23RIESGO

abrir ↗

Nucleihigh

WordPress Simple Job Board <2.9.4 - Local File Inclusion

CVE-2020-35749—

Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2

50RIESGO

abrir ↗

Nucleimedium

twitter-server Cross-Site Scripting

CVE-2020-35774—

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configu

40RIESGO

abrir ↗

Nucleimedium

Cisco ASA/FTD Software - Cross-Site Scripting

CVE-2020-3580MEDIUMbajo ataqueransomware

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities

100RIESGO

abrir ↗

Nucleicritical

Agentejo Cockpit < 0.11.2 - NoSQL Injection

CVE-2020-35846—

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

40RIESGO

abrir ↗

Nucleicritical

Agentejo Cockpit <0.11.2 - NoSQL Injection

CVE-2020-35847—

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.

60RIESGO

abrir ↗

Nucleicritical

Agentejo Cockpit <0.12.0 - NoSQL Injection

CVE-2020-35848—

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

60RIESGO

abrir ↗

Nucleicritical

SAP Solution Manager 7.2 - Remote Command Execution

CVE-2020-6207CRITICALbajo ataque

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform an

100RIESGO

abrir ↗

Nucleicritical

SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition

CVE-2020-6287CRITICALbajo ataque

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication c

100RIESGO

abrir ↗

Nucleimedium

SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

CVE-2020-6308MEDIUM

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated at

60RIESGO

abrir ↗

Nucleicritical

OpenSIS 7.3 - SQL Injection

CVE-2020-6637—

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.

23RIESGO

abrir ↗

Nucleimedium

Eclipse Mojarra - Local File Read

CVE-2020-6950—

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or c

23RIESGO

abrir ↗

Nucleimedium

WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting

CVE-2020-7107—

The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.

18RIESGO

abrir ↗

Nucleicritical

HPE Smart Update Manager < 8.5.6 - Remote Unauthorized Access

CVE-2020-7136—

A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access

40RIESGO

abrir ↗

Nucleicritical

LinuxKI Toolset <= 6.01 - Remote Command Execution

CVE-2020-7209—

LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.

60RIESGO

abrir ↗

Nucleimedium

McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting

CVE-2020-7318MEDIUM

ePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerability

28RIESGO

abrir ↗

Nucleicritical

Zimbra Collaboration Suite < 8.8.15 Patch 7 - Server-Side Request Forgery

CVE-2020-7796CRITICALbajo ataque

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enab

95RIESGO

abrir ↗

Nucleihigh

Puppet Server/PuppetDB - Sensitive Information Disclosure

CVE-2020-7943—

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For Pup

18RIESGO

abrir ↗

Nucleicritical

Liferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code Execution

CVE-2020-7961CRITICALbajo ataque

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.