Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.137exploits catalogados
39.601CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.624Exploit-DB 24.485GitHub PoC 16.337VulnCheck XDB 9678Nuclei 4488Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4488 exploits
Nucleicritical
CrushFTP - Authentication Bypass
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RIESGO
abrir ↗Nucleicritical
SAP NetWeaver Visual Composer Metadata Uploader - Deserialization
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RIESGO
abrir ↗Nucleimedium
Vite server.fs.deny Bypass - Local File Inclusion
Vite allows server.fs.deny to be bypassed with .svg or relative paths
40RIESGO
abrir ↗Nucleihigh
MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads
MinIO performs incomplete signature validation for unsigned-trailer uploads
36RIESGO
abrir ↗Nucleimedium
1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure
WordPress 1 Click WordPress Migration plugin <= 2.5.7 - Sensitive Data Exposure vulnerability
28RIESGO
abrir ↗Nucleihigh
Rocket TRUfusion Enterprise - Server Side Request Forgery
Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is
36RIESGO
abrir ↗Nucleimedium
Vite - Path Traversal
Vite has an `server.fs.deny` bypass with an invalid `request-target`
28RIESGO
abrir ↗Nucleicritical
XWiki Platform - SQL Injection
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
85RIESGO
abrir ↗Nucleimedium
XWiki Platform - Cross-Site Scripting
XWiki Platform contains Reflected XSS vulnerability in two templates
28RIESGO
abrir ↗Nucleicritical
CraftCMS - Remote Code Execution
Craft CMS Allows Remote Code Execution
100RIESGO
abrir ↗Nucleicritical
Langflow AI - Unauthenticated Remote Code Execution
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RIESGO
abrir ↗Nucleihigh
EventON Lite <= 2.4 - Authenticated Local File Inclusion
WordPress EventON plugin <= 2.4 - Local File Inclusion vulnerability
36RIESGO
abrir ↗Nucleicritical
Web-Check < 2.0.1 Screenshot API - OS Command Injection
Web-Check allows command Injection via Unvalidated URL in Screenshot API
68RIESGO
abrir ↗Nucleihigh
Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request
An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.
48RIESGO
abrir ↗Nucleicritical
NetMRI Unauthenticated SQL Injection via skipjackUsername
An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.
55RIESGO
abrir ↗Nucleimedium
NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials
An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.
40RIESGO
abrir ↗Nucleicritical
DataEase 2.10.4-2.10.7 - Remote Code Execution
Dataease H2 JDBC Connection Remote Code Execution
36RIESGO
abrir ↗Nucleicritical
XWiki REST API Query - SQL Injection
org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
65RIESGO
abrir ↗Nucleimedium
XWiki WYSIWYG API - Open Redirect
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
28RIESGO
abrir ↗Nucleihigh
Karel IP Phone IP1211 Web Management Panel - Local File Inclusion
Karel IP Phone IP1211 Path Traversal
36RIESGO
abrir ↗Nucleicritical
Versa Concerto Actuator Endpoint - Authentication Bypass
Versa Concerto Actuator Authentication Bypass Information Leak
100RIESGO
abrir ↗Nucleicritical
Versa Concerto API Path Based - Authentication Bypass
Versa Concerto Authentication Bypass File Write Remote Code Execution
75RIESGO
abrir ↗Nucleicritical
Commvault - SSRF via /commandcenter/deployWebpackage.do
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
100RIESGO
abrir ↗Nucleicritical
vBulletin replaceAdTemplate - Remote Code Execution
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the t
75RIESGO
abrir ↗Nucleihigh
Discourse OAuth Social Login - Cross-site Scripting
Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow
36RIESGO
abrir ↗Nucleicritical
DataEase < 2.10.10 - JWT Authentication Bypass
Dataease Authentication Bypass Vulnerability
41RIESGO
abrir ↗Nucleihigh
DataEase - Remote Code Execution
Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
48RIESGO
abrir ↗Nucleihigh
WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution
WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability
63RIESGO
abrir ↗Nucleicritical
Roundcube Webmail - Remote Code Execution
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the
100RIESGO
abrir ↗Nucleicritical
Pterodactyl Panel - Remote Code Execution
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.