Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.402exploits catalogados
39.049CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.184Exploit-DB 24.485GitHub PoC 16.124VulnCheck XDB 9617Nuclei 4473Metasploit 3519✓ solo verificadosrecientespopularesriesgo
24.485 exploits
Exploit-DB
WordPress 7.0.2 - Path Travesal
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RIESGO
abrir ↗Exploit-DB
Krayin CRM 2.2.4 - IDOR
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
33RIESGO
abrir ↗Exploit-DB
MikroTrick_ 7.24_ 7.24.2_ 7.0.0_ 7.23.4_ 6.0.0_ 6.49.21 - RCE
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RIESGO
abrir ↗Exploit-DB
CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22_ 10.0 < 10.10_ 11.0 < 11.3 - RCE
ILIAS PHP Object Injection via Shibboleth Logout
48RIESGO
abrir ↗Exploit-DB
FreePBX 17.0.2 - Remote Code Execution (RCE)
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗Exploit-DB
Metabase 0.61.0 - Authenticated Remote Code Execution
Metabase: Unsafe Deserialization of H2 Query Results
48RIESGO
abrir ↗Exploit-DB
PodcastGenerator 3.2.9 - Stored XSS
A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote atta
33RIESGO
abrir ↗Exploit-DB
Langflow 1.10.0 - RCE
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RIESGO
abrir ↗Exploit-DB
Bludit CMS 3.20.0 - Reflected Cross-Site Scripting
Bludit CMS Reflected XSS via Search Plugin
48RIESGO
abrir ↗Exploit-DB
Ghost_CMS 6.19.0 - Remote Code Execution
Ghost Vulnerable to Remote Code Execution via Malicious Themes
56RIESGO
abrir ↗Exploit-DB
Marimo 0.20.4 - RCE
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RIESGO
abrir ↗Exploit-DB
EVerest 2025.9.0 - DoS
EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop
41RIESGO
abrir ↗Exploit-DB
EasyAppointments 1.5.1 - Blind SQL Injection
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAp
48RIESGO
abrir ↗Exploit-DB
Grav CMS 2.0.7 - RCE
Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
48RIESGO
abrir ↗Exploit-DB
Payload CMS 3.72.0 - Blind SQL Injection
Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
48RIESGO
abrir ↗Exploit-DB
Wolf CMS 0.8.3.1 - RCE v
Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload
41RIESGO
abrir ↗Exploit-DB
miniOrange 5.4.3 - Unauthenticated Auth Bypass
SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion
48RIESGO
abrir ↗Exploit-DB
CubeCart 6.7.4 - Cross-Site Scripting
CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
33RIESGO
abrir ↗Exploit-DB
CubeCart 6.7.4 - Stored XSS
CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
33RIESGO
abrir ↗Exploit-DB
Linksys E1200_2.0.04 - Unauthenticated OS Command Injection
An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200
38RIESGO
abrir ↗Exploit-DB
Langflow 1.8.4 - Path Traversal to Remote Code Execution
Langflow - Path Traversal Arbitrary File Write via upload_user_file
56RIESGO
abrir ↗Exploit-DB
CubeCart 6.7.4 - SQL injection
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
41RIESGO
abrir ↗Exploit-DB
C-MOR 6.0104 - Directory Traversal
The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' paramete
41RIESGO
abrir ↗Exploit-DB
CubeCart 6.7.4 - SQL
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
41RIESGO
abrir ↗Exploit-DB
C-MOR 6.0104 - Cross-Site Scripting (XSS)
Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to e
33RIESGO
abrir ↗Exploit-DB
CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where th
56RIESGO
abrir ↗Exploit-DB
WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
68RIESGO
abrir ↗Exploit-DB
Joomla JCE_2.9.15 - Remote Code Execution
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
98RIESGO
abrir ↗Exploit-DB
webpack_devserver 5.2.5 - CSRF
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
33RIESGO
abrir ↗página 1 / 817siguiente →
Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.