Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.046exploits catalogados
39.533CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.557Exploit-DB 24.485GitHub PoC 16.313VulnCheck XDB 9678Nuclei 4488Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4488 exploits
Nucleicritical
Kubio AI Page Builder <= 2.5.1 - Local File Inclusion
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
85RIESGO
abrir ↗Nucleicritical
Elestio Memos <= v0.24.0 - Server-Side Request Forgery
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplie
43RIESGO
abrir ↗Nucleicritical
Mongoose - NoSQL Injection
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NO
63RIESGO
abrir ↗Nucleicritical
Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE
Tandoor Recipes - SSTI - Remote Code Execution
43RIESGO
abrir ↗Nucleicritical
Wazuh - Unsafe Deserialization Remote Code Execution
Remote code execution in Wazuh server
100RIESGO
abrir ↗Nucleimedium
Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)
imgproxy is vulnerable to SSRF against 0.0.0.0
48RIESGO
abrir ↗Nucleihigh
Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation
ingress-nginx controller - configuration injection via unsanitized auth-url annotation
68RIESGO
abrir ↗Nucleimedium
12 Step Meeting List < 3.16.6 - Unauthenticated Sensitive Information Exposure
WordPress 12 Step Meeting List plugin <= 3.16.5 - Sensitive Data Exposure vulnerability
28RIESGO
abrir ↗Nucleicritical
Company Visitor Management System 1.0 - SQL Injection
PHPGurukul Company Visitor Management System Sign In index.php sql injection
28RIESGO
abrir ↗Nucleihigh
WhoDB < 0.45.0 - Path Traversal
Path traversal opening Sqlite3 database in WhoDB
43RIESGO
abrir ↗Nucleicritical
GLPI < 10.0.17 - Pre-Auth SQL Injection
GLPI allows unauthenticated SQL injection through the inventory endpoint
78RIESGO
abrir ↗Nucleicritical
Apache Tomcat Path Equivalence - Remote Code Execution
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RIESGO
abrir ↗Nucleicritical
XWiki Platform - Remote Code Execution
Remote code execution as guest via SolrSearchMacros request in xwiki
100RIESGO
abrir ↗Nucleimedium
Vitest Browser Mode - Local File Read
Browser mode serves arbitrary files in vitest
48RIESGO
abrir ↗Nucleicritical
SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection
SugarCRM PHP Deserialization RCE
63RIESGO
abrir ↗Nucleihigh
Aquatronica Controller System <= 5.1.6 - Information Disclosure
Aquatronica Controller System Complete Information Disclosure
63RIESGO
abrir ↗Nucleicritical
WordPress Age Gate <= 3.5.3 - Unauthenticated Local File Inclusion
Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
43RIESGO
abrir ↗Nucleihigh
Omnissa Workspace ONE UEM - Path Traversal
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to ga
61RIESGO
abrir ↗Nucleimedium
Stop User Enumeration WordPress plugin - Authentication Bypass
Stop User Enumeration < 1.7.3 - Protection Bypass
28RIESGO
abrir ↗Nucleicritical
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
68RIESGO
abrir ↗Nucleicritical
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
63RIESGO
abrir ↗Nucleicritical
Ads Pro Plugin <= 4.89 - Local File Inclusion
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion
48RIESGO
abrir ↗Nucleimedium
Liferay Portal - Cross-Site Scripting
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024
28RIESGO
abrir ↗Nucleihigh
Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection
Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection
56RIESGO
abrir ↗Nucleimedium
MapTiler Tileserver-php v2.0 - Unauthenticated XSS
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an e
63RIESGO
abrir ↗Nucleihigh
MapTiler Tileserver-php v2.0 - Unauthenticated File Read
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is resp
56RIESGO
abrir ↗Nucleimedium
MailEnable Mail Service < v10 - Cross-Site Scripting
Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via
75RIESGO
abrir ↗Nucleihigh
White Star Software ProTop - Directory Traversal
A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically
56RIESGO
abrir ↗Nucleicritical
Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution
Authentication Bypass
100RIESGO
abrir ↗Nucleihigh
WordPress Madara Theme < 2.2.2.1 - Local File Inclusion
Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion
68RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.