Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.600exploits catalogados
39.734CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.742Exploit-DB 24.486GitHub PoC 16.618VulnCheck XDB 9736Nuclei 4493Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4493 exploits
Nucleihigh
ZTE ZXHN-F660T/F660A - Default Credentials
ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge o
56RIESGO
abrir ↗Nucleihigh
Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure
docusaurus-plugin-content-gists Exposes GitHub Personal Access Token
43RIESGO
abrir ↗Nucleicritical
Microsoft SharePoint Server - Remote Code Execution (ToolShell)
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RIESGO
abrir ↗Nucleimedium
Microsoft SharePoint Server - Authentication Bypass (ToolShell)
Microsoft SharePoint Server Spoofing Vulnerability
50RIESGO
abrir ↗Nucleicritical
LaRecipe < 2.8.1 Remote Code Execution via SSTI
LaRecipe is vulnerable to Server-Side Template Injection attacks
63RIESGO
abrir ↗Nucleimedium
Directus < 11.9.0 - Version Disclosure
Directus's exact version number is exposed by the OpenAPI Spec
28RIESGO
abrir ↗Nucleicritical
Unauthenticated Arbitrary Plugin Upload in Alone Theme
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
75RIESGO
abrir ↗Nucleicritical
Laravel Livewire v3 - Remote Command Execution
Livewire vulnerable to remote command execution during property update hydration
100RIESGO
abrir ↗Nucleicritical
Hoverfly <= 1.11.3 - Remote Code Execution
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RIESGO
abrir ↗Nucleihigh
XWiki XML View - Sensitive Information Exposure
XWiki Platform: Password and email exposure in xml.vm fields
36RIESGO
abrir ↗Nucleihigh
GeoServer - XML External Entity Injection
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
98RIESGO
abrir ↗Nucleicritical
Flowise <= 3.0.5 - Account Takeover
Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
75RIESGO
abrir ↗Nucleicritical
FOGProject <= 1.5.10.1673 - Authentication Bypass
FOG's authentication bypass leads to full SQL DB dump
68RIESGO
abrir ↗Nucleilow
Vite Dev Server - Path Traversal
Vite middleware may serve files starting with the same name with the public directory
23RIESGO
abrir ↗Nucleihigh
Mockoon < 9.2.0 - Path Traversal
Mockoon has a Path Traversal and LFI in the static file serving endpoint
36RIESGO
abrir ↗Nucleimedium
WordPress Gerencianet Oficial <= 3.1.3 - Unauthenticated Order Status Disclosure
WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerability
28RIESGO
abrir ↗Nucleicritical
Windows Server Update Service - Insecure Deserialization
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
100RIESGO
abrir ↗Nucleimedium
esm.sh <= v136 - Arbitrary File Write via Path Traversal
esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
48RIESGO
abrir ↗Nucleicritical
Service Finder Bookings - Authentication Bypass
Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie
63RIESGO
abrir ↗Nucleimedium
Jenkins Sidepanel - Unauthorized Agent/Queue Exposure
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intent
28RIESGO
abrir ↗Nucleicritical
Flowise - Remote Code Execution
Flowise has Remote Code Execution vulnerability
85RIESGO
abrir ↗Nucleimedium
Ajax Load More < 7.6.1 - Unauthenticated Sensitive Information Exposure
WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerability
28RIESGO
abrir ↗Nucleihigh
WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload
48RIESGO
abrir ↗Nucleimedium
ownCloud Guests - User Enumeration
ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endp
28RIESGO
abrir ↗Nucleihigh
Atarim < 4.2.2 - Sensitive Information Exposure
WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability
56RIESGO
abrir ↗Nucleicritical
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗Nucleimedium
DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting
Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitra
28RIESGO
abrir ↗Nucleihigh
Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion
Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File
36RIESGO
abrir ↗Nucleimedium
WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)
WordPress Qwizcards <= 3.9.4 - Reflected XSS
28RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.