Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.150exploits catalogados
39.601CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.629Exploit-DB 24.485GitHub PoC 16.343VulnCheck XDB 9680Nuclei 4488Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4488 exploits
Nucleihigh
LMDeploy - Server-Side Request Forgery
LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
56RIESGO
abrir ↗Nucleimedium
Mastodon - Open Redirect
Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
28RIESGO
abrir ↗Nucleihigh
MaxSite CMS <=109.1 - Remote Code Execution
MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection
48RIESGO
abrir ↗Nucleihigh
WCAPF WooCommerce Ajax Product Filter - SQL Injection
WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
36RIESGO
abrir ↗Nucleimedium
Dolibarr <=22.0.4 - Local File Inclusion
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
28RIESGO
abrir ↗Nucleicritical
NocoBase - VM Sandbox Escape to Remote Code Execution
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
63RIESGO
abrir ↗Nucleicritical
Apache ActiveMQ - Remote Code Execution
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
91RIESGO
abrir ↗Nucleicritical
CtrlPanel <= 1.1.1 - Remote Code Execution
CtrlPanel: Unauthenticated RCE using installer script
63RIESGO
abrir ↗Nucleicritical
Xerte Online Toolkits <= 3.15 - Remote Code Execution
Xerte Online Toolkits Missing Authentication via connector.php
56RIESGO
abrir ↗Nucleihigh
SiYuan <= v3.6.1 - Bookmark Data Disclosure
SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content
36RIESGO
abrir ↗Nucleicritical
Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
86RIESGO
abrir ↗Nucleimedium
SiYuan Note - Cross-Site Scripting
SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )
36RIESGO
abrir ↗Nucleimedium
Hoppscotch <= 2026.2.1 - Open Redirect
hoppscotch: Open redirect via `/enter?redirect=`
28RIESGO
abrir ↗Nucleihigh
WordPress Media Library Assistant <= 3.34 - SQL Injection
WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability
36RIESGO
abrir ↗Nucleicritical
UniFi OS - Authentication Bypass via Path Traversal (..%2f)
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS de
98RIESGO
abrir ↗Nucleicritical
UniFi OS Server - Command Injection
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS
100RIESGO
abrir ↗Nucleicritical
Dgraph <=v25.3.0 - Admin Mutation Missing Authorization
Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
43RIESGO
abrir ↗Nucleihigh
LiteLLM - Arbitrary File Read
LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
56RIESGO
abrir ↗Nucleihigh
Ech0 < 4.2.8 - Server-Side Request Forgery
Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata
56RIESGO
abrir ↗Nucleicritical
Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana
100RIESGO
abrir ↗Nucleihigh
FortiClient EMS - Authentication Bypass
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta
93RIESGO
abrir ↗Nucleihigh
Planyo Online Reservation System <= 3.0 - Arbitrary File Read
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
56RIESGO
abrir ↗Nucleicritical
WordPress Kali Forms <= 2.4.9 - Remote Code Execution
Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
63RIESGO
abrir ↗Nucleicritical
dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal
Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execut
43RIESGO
abrir ↗Nucleihigh
dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-u
36RIESGO
abrir ↗Nucleicritical
Breeze <= 2.4.4 - Arbitrary File Upload
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
63RIESGO
abrir ↗Nucleicritical
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
68RIESGO
abrir ↗Nucleicritical
ChurchCRM - API Authentication Bypass via URL Injection
ChurchCRM has an API Authentication Bypass
43RIESGO
abrir ↗Nucleimedium
Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal
Frappe has an Arbitrary File Read via Path Traversal in render_include
36RIESGO
abrir ↗Nucleihigh
Vite Dev Server - Directory Traversal
Vite has a `server.fs.deny` bypass with queries
36RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.