Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

79.107exploits catalogados
36.322CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8846Nuclei 4361Metasploit 3490✓ solo verificadosrecientespopularesriesgo
22.910 exploits
Referência✓ VexDay Proof
PHPCC 4.2 Beta - 'nickpage.php?npid' SQL Injection
CVE-2007-0985—webappsphp
SQL injection vulnerability in nickpage.php in phpCC 4.2 beta and earlier allows remote attackers to execute arbitrary S
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Jupiter CMS 1.1.5 - '/index.php' Local/Remote File Inclusion
CVE-2007-0987—webappsphp
Directory traversal vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to include and execute arbit
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Htaccess Passwort Generator 1.1 - 'ht_pfad' Remote File Inclusion
CVE-2007-1013—webappsphp
PHP remote file inclusion vulnerability in generate.php in VirtualSystem Htaccess Passwort Generator 1.1 allows remote a
23RIESGO
abrir ↗
Referência✓ VexDay Proof
webSPELL 4.01.02 - 'showonly' Blind SQL Injection
CVE-2007-1019—webappsphp
SQL injection vulnerability in news.php in webSPELL 4.01.02, when register_globals is enabled, allows remote attackers t
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Snitz Forums 2000 3.1 SR4 - 'pop_profile.asp' SQL Injection
CVE-2007-1023—webappsasp
SQL injection vulnerability in pop_profile.asp in Snitz Forums 2000 3.1 SR4 allows remote attackers to execute arbitrary
23RIESGO
abrir ↗
Referência✓ VexDay Proof
XLAtunes 0.1 - 'album' SQL Injection
CVE-2007-1026—webappsphp
SQL injection vulnerability in view.php in XLAtunes 0.1 and earlier allows remote attackers to execute arbitrary SQL com
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Vivvo Article Manager 3.4 - 'root' Local File Inclusion
CVE-2007-1031—webappsphp
Directory traversal vulnerability in include/db_conn.php in SpoonLabs Vivvo Article Management CMS 3.4 allows remote att
23RIESGO
abrir ↗
Referência
Manage Engine ServiceDesk Plus 10.0 - Privilege Escalation
CVE-2019-10008—webappsjsp
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session
28RIESGO
abrir ↗
Referência
Titan FTP Server Version 2019 Build 3505 - Directory Traversal / Local File Inclusion
CVE-2019-10009—webappswindows
A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated use
28RIESGO
abrir ↗
Referência
CVE-2019-1003000
CVE-2019-1003000—
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/
60RIESGO
abrir ↗
Referência
CVE-2019-1003000
CVE-2019-1003000—
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/
60RIESGO
abrir ↗
Referência
CVE-2019-1003000
CVE-2019-1003000—
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/
60RIESGO
abrir ↗
Referência
CVE-2019-1003001
CVE-2019-1003001—
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
60RIESGO
abrir ↗
Referência
CVE-2019-1003002
CVE-2019-1003002—
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src
60RIESGO
abrir ↗
Referência
CVE-2019-10149
CVE-2019-10149CRITICALbajo ataque
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RIESGO
abrir ↗
Referência
CVE-2019-10149
CVE-2019-10149CRITICALbajo ataque
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RIESGO
abrir ↗
Referência
CVE-2019-10149
CVE-2019-10149CRITICALbajo ataque
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RIESGO
abrir ↗
Referência
CVE-2019-10664
CVE-2019-10664—
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
23RIESGO
abrir ↗
Referência
CVE-2021-46398
CVE-2021-46398—
A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor use
23RIESGO
abrir ↗
Referência
TeemIp IPAM < 2.4.0 - 'new_config' Command Injection (Metasploit)
CVE-2019-10863—remotephp
A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows on
28RIESGO
abrir ↗
Referência✓ VexDay Proof
SaveWeb Portal 3.4 - 'SITE_Path' Remote File Inclusion
CVE-2006-4012—webappsphp
Multiple PHP remote file inclusion vulnerabilities in circeOS SaveWeb Portal 3.4 allow remote attackers to execute arbit
23RIESGO
abrir ↗
Referência
CVE-2019-10893
CVE-2019-10893—
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to
23RIESGO
abrir ↗
Referência
CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) - Cross-Site Scripting
CVE-2019-10893—webappslinux
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to
23RIESGO
abrir ↗
Referência
D-Link DI-524 V2.06RU - Multiple Cross-Site Scripting
CVE-2019-11017—webappshardware
On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration:
23RIESGO
abrir ↗
Referência
DirectAdmin 1.561 - Multiple Vulnerabilities
CVE-2019-11193—webappsphp
The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESE
23RIESGO
abrir ↗
Referência
CVE-2019-11354
CVE-2019-11354—
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Ori
28RIESGO
abrir ↗
Referência
CVE-2019-11354
CVE-2019-11354—
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Ori
28RIESGO
abrir ↗
Referência✓ VexDay Proof
XM Easy Personal FTP Server 5.30 - 'ABOR' Format String Denial of Service
CVE-2007-1195—doswindows
Multiple buffer overflows in XM Easy Personal FTP Server 5.3.0 allow remote attackers to execute arbitrary code via unsp
23RIESGO
abrir ↗
Referência✓ VexDay Proof
Admin Phorum 3.3.1a - 'del.php?include_path' Remote File Inclusion
CVE-2007-1219—webappsphp
PHP remote file inclusion vulnerability in actions/del.php in Admin Phorum 3.3.1a allows remote attackers to execute arb
23RIESGO
abrir ↗
Referência✓ VexDay Proof
NetProxy 4.03 - Web Filter Evasion / Bypass Logging
CVE-2007-1225—remotewindows
The connection log file implementation in Grok Developments NetProxy 4.03 does not record requests that omit http:// in
23RIESGO
abrir ↗
← anteriorpágina 762 / 764siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.