Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

78.958exploits catalogados

36.206CVEs con explotación pública

24.695probados en laboratorio

Todos Exploit-DB 24.460Referência 22.832GitHub PoC 14.991VulnCheck XDB 8829Nuclei 4357Metasploit 3489✓ solo verificadosrecientes populares riesgo

4357 exploits

Nucleimedium

Alfresco Share - Open Redirect

CVE-2019-14223—

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share applicat

18RIESGO

abrir ↗

Nucleihigh

T24 Web Server - Local File Inclusion

CVE-2019-14251—

An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a docu

18RIESGO

abrir ↗

Nucleimedium

Aptana Jaxer 1.0.3.4547 - Local File inclusion

CVE-2019-14312—

Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This v

43RIESGO

abrir ↗

Nucleihigh

Pallets Werkzeug <0.15.5 - Local File Inclusion

CVE-2019-14322—

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

50RIESGO

abrir ↗

Nucleimedium

WordPress UserPro 4.9.32 - Cross-Site Scripting

CVE-2019-14470—

cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has X

60RIESGO

abrir ↗

Nucleihigh

OpenEMR <5.0.2 - Local File Inclusion

CVE-2019-14530—

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can

50RIESGO

abrir ↗

Nucleimedium

Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting

CVE-2019-14696—

Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.

43RIESGO

abrir ↗

Nucleimedium

osTicket < 1.12.1 - Cross-Site Scripting

CVE-2019-14750—

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It w

43RIESGO

abrir ↗

Nucleimedium

Custom 404 Pro < 3.2.8 - Cross-Site Scripting

CVE-2019-14789—

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.

18RIESGO

abrir ↗

Nucleihigh

Meta Box <= 4.16.2 - Arbitrary File Deletion

CVE-2019-14793—

The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=r

18RIESGO

abrir ↗

Nucleimedium

WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scripting

CVE-2019-14950—

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.

18RIESGO

abrir ↗

Nucleimedium

SugarCRM Enterprise 9.0.0 - Cross-Site Scripting

CVE-2019-14974—

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.

43RIESGO

abrir ↗

Nucleihigh

Grafana - Improper Access Control

CVE-2019-15043—

In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run

30RIESGO

abrir ↗

Nucleicritical

Webmin <= 1.920 - Unauthenticated Remote Command Execution

CVE-2019-15107CRITICALbajo ataqueransomware

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RIESGO

abrir ↗

Nucleimedium

L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting

CVE-2019-15501—

Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.

38RIESGO

abrir ↗

Nucleihigh

Webmin < 1.920 - Authenticated Remote Code Execution

CVE-2019-15642—

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise

50RIESGO

abrir ↗

Nucleimedium

WordPress My Calendar <= 3.1.9 - Cross-Site Scripting

CVE-2019-15713—

The my-calendar plugin before 3.1.10 for WordPress has XSS.

18RIESGO

abrir ↗

Nucleimedium

ND Booking < 2.5 - Unauthenticated Options Change

CVE-2019-15774—

The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting

18RIESGO

abrir ↗

Nucleimedium

DomainMOD <=4.13.0 - Cross-Site Scripting

CVE-2019-15811—

In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.

38RIESGO

abrir ↗

Nucleihigh

WPS Hide Login <= 1.5.2.2 - Login Page Bypass

CVE-2019-15823—

The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.

18RIESGO

abrir ↗

Nucleimedium

Gallery Photoblocks < 1.1.43 - Cross-Site Scripting

CVE-2019-15829—

The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.

18RIESGO

abrir ↗

Nucleihigh

WordPress Woody Ad Snippets <2.2.5 - Cross-Site Scripting/Remote Code Execution

CVE-2019-15858—

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthentica

23RIESGO

abrir ↗

Nucleicritical

Socomec DIRIS A-40 Devices Password Disclosure

CVE-2019-15859—

Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get f

30RIESGO

abrir ↗

Nucleimedium

WordPress Download Manager <2.9.94 - Cross-Site Scripting

CVE-2019-15889MEDIUM

The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by t

53RIESGO

abrir ↗

Nucleicritical

D-Link DNS-320 - Remote Code Execution

CVE-2019-16057CRITICALbajo ataqueransomware

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

95RIESGO

abrir ↗

Nucleicritical

Enigma NMS < 65.0.0 - Authenticated OS Command Injection

CVE-2019-16072—

An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows

43RIESGO

abrir ↗

Nucleimedium

Harbor <=1.82.0 - Privilege Escalation

CVE-2019-16097—

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users A

23RIESGO

abrir ↗

Nucleihigh

PilusCart <=1.4.1 - Local File Inclusion

CVE-2019-16123—

In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File D

23RIESGO

abrir ↗

Nucleicritical

nostromo 1.9.6 - Remote Code Execution

CVE-2019-16278CRITICALbajo ataque

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

100RIESGO

abrir ↗

Nucleihigh

ifw8 Router ROM v4.31 - Credential Discovery

CVE-2019-16313—

ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.

30RIESGO

abrir ↗

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.