Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.035exploits catalogados
39.531CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4478Metasploit 3524✓ solo verificadosrecientespopularesriesgo
4478 exploits
Nucleihigh
InvoicePlane <= 1.6.3 - Arbitrary File Read
InvoicePlane has Unauthenticated Path Traversal in Guest Controller
43RIESGO
abrir ↗Nucleihigh
Feast Feature Server <=0.58.0 - Arbitrary File Read
Feast: unauthenticated arbitrary file read
36RIESGO
abrir ↗Nucleihigh
Modular DS - Broken Access Control
WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability
68RIESGO
abrir ↗Nucleihigh
ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy
ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint
43RIESGO
abrir ↗Nucleicritical
Windmill < 1.603.3 - SQL Injection
Windmill < 1.603.3 File Ownership Handling SQLi RCE
68RIESGO
abrir ↗Nucleicritical
MCPJam Inspector - Remote Code Execution
REC in MCPJam inspector due to HTTP Endpoint exposes
75RIESGO
abrir ↗Nucleicritical
SmarterTools SmarterMail - Admin Password Reset
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
100RIESGO
abrir ↗Nucleimedium
XWiki Platform Distribution Flavor Main - Cross-Site Scripting
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
28RIESGO
abrir ↗Nucleihigh
Ally – Web Accessibility & Usability <= 4.0.3 - SQL Injection
Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
36RIESGO
abrir ↗Nucleihigh
Geo Mashup <= 1.13.17 - SQL Injection
Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter
36RIESGO
abrir ↗Nucleicritical
NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succes
63RIESGO
abrir ↗Nucleicritical
LoLLMs WEBUI - Server-Side Request Forgery
LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint
43RIESGO
abrir ↗Nucleimedium
Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload
Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload
28RIESGO
abrir ↗Nucleimedium
Discourse - Private Group Membership Inference via exclude_groups
Discourse has inferable private group membership or existence via exclude_groups parameter
28RIESGO
abrir ↗Nucleicritical
OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization
Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
43RIESGO
abrir ↗Nucleihigh
SiYuan <= v3.6.1 - Path Traversal
SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal
36RIESGO
abrir ↗Nucleicritical
AVideo <= 26.0 - WWBN AVideo - Remote Code Execution
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
48RIESGO
abrir ↗Nucleihigh
Langflow < 1.7.0 - Path Traversal
Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading
36RIESGO
abrir ↗Nucleimedium
EspoCRM <= 9.3.3 - Server-Side Request Forgery
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
48RIESGO
abrir ↗Nucleihigh
LMDeploy - Server-Side Request Forgery
LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
56RIESGO
abrir ↗Nucleimedium
Mastodon - Open Redirect
Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
28RIESGO
abrir ↗Nucleihigh
MaxSite CMS <=109.1 - Remote Code Execution
MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection
48RIESGO
abrir ↗Nucleihigh
WCAPF WooCommerce Ajax Product Filter - SQL Injection
WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
36RIESGO
abrir ↗Nucleimedium
Dolibarr <=22.0.4 - Local File Inclusion
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
28RIESGO
abrir ↗Nucleicritical
NocoBase - VM Sandbox Escape to Remote Code Execution
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
63RIESGO
abrir ↗Nucleicritical
Apache ActiveMQ - Remote Code Execution
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
91RIESGO
abrir ↗Nucleicritical
CtrlPanel <= 1.1.1 - Remote Code Execution
CtrlPanel: Unauthenticated RCE using installer script
63RIESGO
abrir ↗Nucleicritical
Xerte Online Toolkits <= 3.15 - Remote Code Execution
Xerte Online Toolkits Missing Authentication via connector.php
56RIESGO
abrir ↗Nucleihigh
SiYuan <= v3.6.1 - Bookmark Data Disclosure
SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content
36RIESGO
abrir ↗Nucleicritical
Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
86RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.