Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
72.018exploits catalogados
32.219CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8195Nuclei 4217Metasploit 3463✓ solo verificadosrecientespopularesriesgo
4217 exploits
Nucleicritical
n8n - Remote Code Execution via Expression Injection
n8n Vulnerable to Remote Code Execution via Expression Injection
100RIESGO
abrir ↗Nucleihigh
Zimbra Collaboration - Local File Inclusion
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1
98RIESGO
abrir ↗Nucleihigh
phpMyFAQ - Configuration Backup Disclosure
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
36RIESGO
abrir ↗Nucleicritical
The Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalation
Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
68RIESGO
abrir ↗Nucleihigh
ionCube Tester Plus <= 1.3 - Local File Inclusion
WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability
36RIESGO
abrir ↗Nucleicritical
WordPress Events Manager <= 7.0.3 - SQL Injection
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
48RIESGO
abrir ↗Nucleicritical
FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-code
43RIESGO
abrir ↗Nucleicritical
SPIP Saisies - Remote Code Execution
SPIP Saisies Plugin < 5.11.1 Remote Code Execution
63RIESGO
abrir ↗Nucleimedium
BMC FootPrints - Authentication Bypass
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass
48RIESGO
abrir ↗Nucleihigh
BMC FootPrints 'searchWeb' - Server-Side Request Forgery
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb
33RIESGO
abrir ↗Nucleihigh
BMC FootPrints 'feedUrl' - Server-Side Request Forgery
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS
33RIESGO
abrir ↗Nucleicritical
Zoo Management System 1.0 - SQL Injection
PHPGurukul Zoo Management System index.php sql injection
28RIESGO
abrir ↗Nucleihigh
Ditty < 3.1.58 - Server-Side Request Forgery
Ditty < 3.1.58 - Unauthenticated SSRF
41RIESGO
abrir ↗Nucleihigh
Gogs <= 0.13.3 - Remote Code Execution
File overwrite in file update API in Gogs
100RIESGO
abrir ↗Nucleicritical
ChanCMS <= 3.1. - Remote Code Execution
yanyutao0402 ChanCMS collect.js getArticle deserialization
28RIESGO
abrir ↗Nucleimedium
LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header
HTML Injection in Accept-Language Header in danny-avila/librechat
28RIESGO
abrir ↗Nucleicritical
Chef Automate < 4.13.295 — SQL Injection
Chef Automate compliance service SQL Injection Vulnerability
48RIESGO
abrir ↗Nucleicritical
Flowise < 3.0.1 - Remote Command Execution
Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers
65RIESGO
abrir ↗Nucleimedium
Trinity Audio <= 5.21.0 - Information Exposure
Trinity Audio <= 5.21.0 - Unauthenticated Information Exposure
28RIESGO
abrir ↗Nucleicritical
RestroPress 3.0.0-3.2.1 - Authentication Bypass
RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
63RIESGO
abrir ↗Nucleimedium
N-central - Authentication Bypass
N-central unauthenticated sessionID generation
60RIESGO
abrir ↗Nucleicritical
Loan Management System 1.0 - SQL Injection
Campcodes Online Loan Management System ajax.php sql injection
28RIESGO
abrir ↗Nucleimedium
The Events Calendar <= 6.15.2 - Information Disclosure
The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
28RIESGO
abrir ↗Nucleimedium
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
33RIESGO
abrir ↗Nucleicritical
MLflow Job API - Authentication Bypass
Missing Authentication for Critical Function in mlflow/mlflow
36RIESGO
abrir ↗Nucleihigh
LolLMS < 2.2.0 - Server-Side Request Forgery
Server-Side Request Forgery (SSRF) in parisneo/lollms
36RIESGO
abrir ↗Nucleimedium
WordPress List Site Contributors < 1.1.8 - Reflected XSS
List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha
28RIESGO
abrir ↗Nucleicritical
Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RIESGO
abrir ↗Nucleicritical
Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
100RIESGO
abrir ↗Nucleihigh
Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
28RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.