Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

72.018exploits catalogados
32.219CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 20.023GitHub PoC 13.334VulnCheck XDB 8195Nuclei 4217Metasploit 3463✓ solo verificadosrecientespopularesriesgo
4217 exploits
Nucleicritical
WordPress Contact Form by Supsystic - Server-Side Template Injection
CVE-2026-4257CRITICAL
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
75RIESGO
abrir ↗
Nucleicritical
Gotenberg - Command Injection
CVE-2026-42589CRITICAL
Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
63RIESGO
abrir ↗
Nucleicritical
JoomSport <= 5.7.7 - SQL Injection
CVE-2026-42647CRITICAL
WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability
63RIESGO
abrir ↗
Nucleicritical
Arelle < 2.39.10 - Remote Code Execution
CVE-2026-42796CRITICAL
Arelle < 2.39.10 Unauthenticated RCE via /rest/configure
43RIESGO
abrir ↗
Nucleicritical
Scramble Laravel - Remote Code Execution
CVE-2026-44262CRITICAL
Scramble: Remote code execution via evaluation of user-controlled input in validation rules
63RIESGO
abrir ↗
Nucleicritical
Open WebUI 'LDAP Empty Password' - Authentication Bypass
CVE-2026-44551CRITICAL
Open WebUI: LDAP Empty Password Authentication Bypass
43RIESGO
abrir ↗
Nucleihigh
Dozzle - Server Side Request Forgery
CVE-2026-45298HIGH
Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)
36RIESGO
abrir ↗
Nucleimedium
Open WebUI < 0.9.5 - Information Disclosure
CVE-2026-45397MEDIUM
Open WebUI: Unauthenticated RAG Configuration Disclosure
28RIESGO
abrir ↗
Nucleicritical
Cockpit Web Console < 360 - Remote Code Execution
CVE-2026-4631CRITICAL
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
68RIESGO
abrir ↗
Nucleicritical
9Router <= 0.4.36 - Unauthenticated RCE
CVE-2026-46339CRITICAL
9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
43RIESGO
abrir ↗
Nucleicritical
phpMyFAQ <= 4.1.1 - SQL Injection
CVE-2026-46364CRITICAL
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
43RIESGO
abrir ↗
Nucleihigh
SillyTavern - Server-Side Request Forgery
CVE-2026-46372HIGH
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
36RIESGO
abrir ↗
Nucleicritical
Flowise < 3.1.2 - node-custom-function Unauthorized RCE
CVE-2026-46442CRITICAL
Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
63RIESGO
abrir ↗
Nucleicritical
TYPO3 ceselector Extension - Insecure Deserialization
CVE-2026-46725CRITICAL
Remote Code Execution in extension "Content Element Selector" (ceselector)
43RIESGO
abrir ↗
Nucleicritical
DbGate - Remote Code Execution via Anonymous JWT
CVE-2026-47668CRITICAL
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
63RIESGO
abrir ↗
Nucleicritical
DbGate - Remote Code Execution via Dynamic Import Bypass
CVE-2026-47670CRITICAL
DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
63RIESGO
abrir ↗
Nucleicritical
Google ADK-Python - Unauthenticated Builder Endpoint
CVE-2026-4810CRITICAL
Remote Code Execution in Google Agent Development Kit (ADK)
43RIESGO
abrir ↗
← anteriorpágina 141 / 141

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.