Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.600exploits catalogados
39.734CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.742Exploit-DB 24.486GitHub PoC 16.618VulnCheck XDB 9736Nuclei 4493Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4493 exploits
Nucleicritical
WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution
Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution
43RIESGO
abrir ↗Nucleihigh
Yoco Payments <= 3.8.8 - Path Traversal
Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read
36RIESGO
abrir ↗Nucleimedium
WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure
WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action
28RIESGO
abrir ↗Nucleimedium
LearnPress < 4.3.2 - Broken Access Control
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
28RIESGO
abrir ↗Nucleimedium
User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion
WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
28RIESGO
abrir ↗Nucleihigh
Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection
Team < 5.0.11 - Unauthenticated SQLi
36RIESGO
abrir ↗Nucleimedium
Premium Addons for Elementor - Unauthenticated Information Disclosure
Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'
28RIESGO
abrir ↗Nucleihigh
Payara Server - Cross-Site Scripting
Admin Account Takeover via malicious URL payload
36RIESGO
abrir ↗Nucleihigh
WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File
Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
36RIESGO
abrir ↗Nucleihigh
D-Link DIR-803 - Authentication Bypass
D-Link DIR-803 Configuration getcfg.php information disclosure
28RIESGO
abrir ↗Nucleicritical
Gladinet CentreStack & Triofox - Hardcoded Credentials
Gladinet CentreStack and TrioFox Hard Coded AES Keys
98RIESGO
abrir ↗Nucleimedium
WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure
Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints
28RIESGO
abrir ↗Nucleicritical
Branda WordPress plugin - Privilege Escalation
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover
63RIESGO
abrir ↗Nucleicritical
RegistrationMagic <= 6.0.7.1 - Privilege Escalation
RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
43RIESGO
abrir ↗Nucleicritical
Sangfor OSM - Arbitrary File Upload
Sangfor Operation and Maintenance Management System common.jsp unrestricted upload
28RIESGO
abrir ↗Nucleicritical
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation
63RIESGO
abrir ↗Nucleimedium
EasyCVR <=2.1.2 - Information Disclosure
Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosure
28RIESGO
abrir ↗Nucleicritical
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
75RIESGO
abrir ↗Nucleihigh
Pichome 2.1.0 - Arbitrary File Read
zyx0814 Pichome index.php path traversal
28RIESGO
abrir ↗Nucleicritical
Ingress-Nginx Controller - Remote Code Execution
ingress-nginx admission controller RCE escalation
85RIESGO
abrir ↗Nucleihigh
D-Link DIR-823X set_prohibiting - Command Injection
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrar
88RIESGO
abrir ↗Nucleihigh
XWiki REST API - Private Pages Disclosure
XWiki allows unregistered users to access private pages information through REST endpoint
36RIESGO
abrir ↗Nucleimedium
Vite - Arbitrary File Read
Vite bypasses server.fs.deny when using `?raw??`
70RIESGO
abrir ↗Nucleicritical
GeoServer WFS - XXE Processing Vulnerability
GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling
55RIESGO
abrir ↗Nucleicritical
Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the
100RIESGO
abrir ↗Nucleihigh
WordPress WP01 - Path Traversal
WordPress WP01 plugin <= 2.6.2 - Arbitrary File Download Vulnerability
56RIESGO
abrir ↗Nucleihigh
SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass
SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation
78RIESGO
abrir ↗Nucleimedium
Vite Development Server - Path Traversal
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
90RIESGO
abrir ↗Nucleihigh
Yeswiki < 4.5.2 - Unauthenticated Path Traversal
Path Traversal allowing arbitrary read of files in Yeswiki
56RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.