Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
83.402exploits catalogados
39.049CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.184Exploit-DB 24.485GitHub PoC 16.124VulnCheck XDB 9617Nuclei 4473Metasploit 3519✓ solo verificadosrecientespopularesriesgo
3519 exploits
Metasploit300
GitLab Unauthenticated Arbitrary File Read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RIESGO
abrir ↗Metasploit500
N-able N-central Struts BeanUtils Unauthenticated RCE
pre-authentication remote code execution
98RIESGO
abrir ↗Metasploit600
Langflow AI Validate Code Injection unauth RCE
Langflow code Code Injection Remote Code Execution Vulnerability
68RIESGO
abrir ↗Metasploit500
SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern
93RIESGO
abrir ↗Metasploit500
SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi
66RIESGO
abrir ↗Metasploit600
Langflow AI authenticated RCE
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
63RIESGO
abrir ↗Metasploit600
Langflow AI Custom Component Authenticated RCE
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
56RIESGO
abrir ↗Metasploit600
PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)
PaperCut MF/NG: Authentication Bypass
100RIESGO
abrir ↗Metasploit600
PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
100RIESGO
abrir ↗Metasploit600
Next.js Unauthenticated RCE on Windows Servers
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
63RIESGO
abrir ↗Metasploit600
SPIP X-Spip-Filtre Unauthenticated RCE
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August
43RIESGO
abrir ↗Metasploit600
Tenable Security Center SCAP Audit File Command Injection
Command Injection
63RIESGO
abrir ↗Metasploit300
Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution
# Active Storage allowed transformation methods potentially unsafe
Active Storage attempts to prevent the use of pote
63RIESGO
abrir ↗Metasploit300
Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
68RIESGO
abrir ↗Metasploit600
JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin
100RIESGO
abrir ↗Metasploit600
Check Point SmartConsole Authentication Bypass Run Script RCE
Authentication Bypass in the SmartConsole Login Process Using an Application Token
100RIESGO
abrir ↗Metasploit600
Langflow AI auto_login RCE
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
98RIESGO
abrir ↗Metasploit600
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RIESGO
abrir ↗Metasploit300
WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗Metasploit300
WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RIESGO
abrir ↗Metasploit600
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RIESGO
abrir ↗Metasploit600
SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A
93RIESGO
abrir ↗Metasploit300
Wordpress Planyo Online Reservation System Arbitrary File Read (CVE-2026-3576)
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
56RIESGO
abrir ↗Metasploit600
Langflow AI Code Validation Authenticated RCE
Code Injection Vulnerability in Code Validation Endpoint
63RIESGO
abrir ↗Metasploit600
Flowise MCP Server Remote Code Execution
Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess
36RIESGO
abrir ↗Metasploit600
SimpleHelp OIDC Authentication Bypass Remote Code Execution
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
93RIESGO
abrir ↗Metasploit300
4gaBoards Mass User Information Disclosure (CVE-2026-53959)
4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user
48RIESGO
abrir ↗Metasploit600
Joomla Content Editor Unauthenticated File Upload RCE
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
98RIESGO
abrir ↗Metasploit500
HP Poly Voice Unauthenticated Remote Code Execution
Poly Voice – Possible Remote Control of Certain Poly Devices
55RIESGO
abrir ↗página 1 / 118siguiente →
Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.