Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.600exploits catalogados
39.734CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.742Exploit-DB 24.486GitHub PoC 16.618VulnCheck XDB 9736Nuclei 4493Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4493 exploits
Nucleicritical
Flowise - Remote Code Execution
Flowise has Remote Code Execution vulnerability
85RIESGO
abrir ↗Nucleimedium
Ajax Load More < 7.6.1 - Unauthenticated Sensitive Information Exposure
WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerability
28RIESGO
abrir ↗Nucleihigh
WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload
48RIESGO
abrir ↗Nucleimedium
ownCloud Guests - User Enumeration
ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endp
28RIESGO
abrir ↗Nucleihigh
Atarim < 4.2.2 - Sensitive Information Exposure
WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability
56RIESGO
abrir ↗Nucleicritical
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗Nucleimedium
DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting
Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitra
28RIESGO
abrir ↗Nucleihigh
Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion
Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File
36RIESGO
abrir ↗Nucleimedium
WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)
WordPress Qwizcards <= 3.9.4 - Reflected XSS
28RIESGO
abrir ↗Nucleicritical
Oracle Identity Manager REST WebServices - Authentication Bypass
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported vers
100RIESGO
abrir ↗Nucleicritical
Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integratio
100RIESGO
abrir ↗Nucleihigh
Oracle E-Business Suite - Server-Side Request Forgery
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions
100RIESGO
abrir ↗Nucleimedium
Open Redirect via Organization Switching
An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.
Prerequisites
50RIESGO
abrir ↗Nucleihigh
AI ChatBot with ChatGPT by AYS <= 2.6.6 - Unauthenticated API Key Exposure
WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.6.6 - Sensitive Data Exposure vulnerability
36RIESGO
abrir ↗Nucleicritical
DELMIA Apriso - Command Injection
Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
88RIESGO
abrir ↗Nucleihigh
DELMIA Apriso - Broken Access Control
Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
95RIESGO
abrir ↗Nucleimedium
WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure
WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Sensitive Data Exposure vulnerability
28RIESGO
abrir ↗Nucleicritical
Squid Proxy - HTTP Authentication Credentials Disclosure
Squid vulnerable to information disclosure via authentication credential leakage in error handling
75RIESGO
abrir ↗Nucleimedium
Piwigo - User Enumeration via Password Reset
Piwigo Vulnerable to User Enumeration via Password Reset Endpoint
28RIESGO
abrir ↗Nucleimedium
Vite - Information Disclosure
vite allows server.fs.deny bypass via backslash on Windows
28RIESGO
abrir ↗Nucleicritical
Ray < 2.52.0 - Remote Code Execution
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
100RIESGO
abrir ↗Nucleimedium
VDO.Ninja - DOM-Based Cross-Site Scripting
VDO.Ninja Reflected XSS Vulnerability in control.html
28RIESGO
abrir ↗Nucleimedium
ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API
changedetection.io vulnerable to stored XSS in Watch update via API
23RIESGO
abrir ↗Nucleimedium
Dify v1.9.1 - Broken Access Control
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to th
41RIESGO
abrir ↗Nucleicritical
Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func
Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
85RIESGO
abrir ↗Nucleicritical
Code-Projects School Fees Payment System 1.0 - SQL Injection
code-projects School Fees Payment System student.php sql injection
28RIESGO
abrir ↗Nucleicritical
DNN - Unrestricted Arbitrary File Upload
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
75RIESGO
abrir ↗Nucleicritical
FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection
FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
100RIESGO
abrir ↗Nucleicritical
FortiWeb - Authentication Bypass
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
100RIESGO
abrir ↗Nucleihigh
Symfony HttpFoundation - Access Control Bypass via PATH_INFO
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
36RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.