Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
72.018exploits catalogados
32.219CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8195Nuclei 4217Metasploit 3463✓ solo verificadosrecientespopularesriesgo
4217 exploits
Nucleicritical
Mesop AI Sandbox <= 1.2.2 - Remote Code Execution
Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
43RIESGO
abrir ↗Nucleicritical
LoLLMs WEBUI - Server-Side Request Forgery
LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint
48RIESGO
abrir ↗Nucleicritical
OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization
Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
48RIESGO
abrir ↗Nucleihigh
SiYuan <= v3.6.1 - Path Traversal
SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal
36RIESGO
abrir ↗Nucleicritical
AVideo <= 26.0 - WWBN AVideo - Remote Code Execution
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
48RIESGO
abrir ↗Nucleihigh
Langflow < 1.7.0 - Path Traversal
Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading
41RIESGO
abrir ↗Nucleimedium
EspoCRM <= 9.3.3 - Server-Side Request Forgery
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
48RIESGO
abrir ↗Nucleihigh
LMDeploy - Server-Side Request Forgery
LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
68RIESGO
abrir ↗Nucleimedium
Mastodon - Open Redirect
Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'
28RIESGO
abrir ↗Nucleihigh
WCAPF WooCommerce Ajax Product Filter - SQL Injection
WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
36RIESGO
abrir ↗Nucleicritical
NocoBase - VM Sandbox Escape to Remote Code Execution
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
75RIESGO
abrir ↗Nucleicritical
Apache ActiveMQ - Remote Code Execution
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
100RIESGO
abrir ↗Nucleicritical
Xerte Online Toolkits <= 3.15 - Remote Code Execution
Xerte Online Toolkits Missing Authentication via connector.php
56RIESGO
abrir ↗Nucleihigh
SiYuan <= v3.6.1 - Bookmark Data Disclosure
SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content
36RIESGO
abrir ↗Nucleicritical
Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
68RIESGO
abrir ↗Nucleimedium
SiYuan Note - Cross-Site Scripting
SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )
36RIESGO
abrir ↗Nucleimedium
Hoppscotch <= 2026.2.1 - Open Redirect
hoppscotch: Open redirect via `/enter?redirect=`
28RIESGO
abrir ↗Nucleihigh
WordPress Media Library Assistant <= 3.34 - SQL Injection
WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability
36RIESGO
abrir ↗Nucleicritical
UniFi OS Server - Command Injection
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS
95RIESGO
abrir ↗Nucleihigh
LiteLLM - Arbitrary File Read
LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
61RIESGO
abrir ↗Nucleicritical
Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana
100RIESGO
abrir ↗Nucleihigh
FortiClient EMS - Authentication Bypass
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta
100RIESGO
abrir ↗Nucleicritical
WordPress Kali Forms <= 2.4.9 - Remote Code Execution
Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
63RIESGO
abrir ↗Nucleicritical
dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal
Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execut
43RIESGO
abrir ↗Nucleihigh
dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-u
36RIESGO
abrir ↗Nucleicritical
Breeze <= 2.4.4 - Arbitrary File Upload
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
75RIESGO
abrir ↗Nucleicritical
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
43RIESGO
abrir ↗Nucleicritical
ChurchCRM - API Authentication Bypass via URL Injection
ChurchCRM has an API Authentication Bypass
43RIESGO
abrir ↗Nucleimedium
Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal
Frappe has an Arbitrary File Read via Path Traversal in render_include
36RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.