Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.600exploits catalogados
39.734CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.742Exploit-DB 24.486GitHub PoC 16.618VulnCheck XDB 9736Nuclei 4493Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4493 exploits
Nucleihigh
ZTE ZXHN-F660T/F660A - Default Credentials
ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge o
56RIESGO
abrir ↗Nucleihigh
Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure
docusaurus-plugin-content-gists Exposes GitHub Personal Access Token
43RIESGO
abrir ↗Nucleicritical
Microsoft SharePoint Server - Remote Code Execution (ToolShell)
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RIESGO
abrir ↗Nucleimedium
Microsoft SharePoint Server - Authentication Bypass (ToolShell)
Microsoft SharePoint Server Spoofing Vulnerability
50RIESGO
abrir ↗Nucleicritical
LaRecipe < 2.8.1 Remote Code Execution via SSTI
LaRecipe is vulnerable to Server-Side Template Injection attacks
63RIESGO
abrir ↗Nucleimedium
Directus < 11.9.0 - Version Disclosure
Directus's exact version number is exposed by the OpenAPI Spec
28RIESGO
abrir ↗Nucleicritical
Unauthenticated Arbitrary Plugin Upload in Alone Theme
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
75RIESGO
abrir ↗Nucleicritical
Laravel Livewire v3 - Remote Command Execution
Livewire vulnerable to remote command execution during property update hydration
100RIESGO
abrir ↗Nucleicritical
Hoverfly <= 1.11.3 - Remote Code Execution
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RIESGO
abrir ↗Nucleihigh
XWiki XML View - Sensitive Information Exposure
XWiki Platform: Password and email exposure in xml.vm fields
36RIESGO
abrir ↗Nucleicritical
Code-Projects School Fees Payment System 1.0 - SQL Injection
code-projects School Fees Payment System student.php sql injection
28RIESGO
abrir ↗Nucleicritical
DNN - Unrestricted Arbitrary File Upload
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
75RIESGO
abrir ↗Nucleicritical
FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection
FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
100RIESGO
abrir ↗Nucleicritical
FortiWeb - Authentication Bypass
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
100RIESGO
abrir ↗Nucleihigh
Symfony HttpFoundation - Access Control Bypass via PATH_INFO
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
36RIESGO
abrir ↗Nucleimedium
Astro - Broken Access Control
Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass
28RIESGO
abrir ↗Nucleihigh
Astro - Reflected XSS via server islands feature
Astro is vulnerable to Reflected XSS via the server islands feature
36RIESGO
abrir ↗Nucleimedium
XWiki DeleteApplication - Cross-Site Scripting
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
28RIESGO
abrir ↗Nucleihigh
Apache Tika - XML External Entity Injection
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
58RIESGO
abrir ↗Nucleihigh
Yonyou YonBIP - Path Traversal
In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to
36RIESGO
abrir ↗Nucleicritical
ComfyUI-Manager < 3.38 - Configuration Overwrite
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration a
56RIESGO
abrir ↗Nucleihigh
LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization
WordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerability
36RIESGO
abrir ↗Nucleimedium
Signal K Server <= 2.18.0 - Information Disclosure
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
28RIESGO
abrir ↗Nucleihigh
Apache Struts XWork - XML External Entity Injection
Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component
48RIESGO
abrir ↗Nucleimedium
User Submitted Posts <= 20251121 - Unauthenticated Open Redirect
WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability
28RIESGO
abrir ↗Nucleihigh
WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF
Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery
36RIESGO
abrir ↗Nucleimedium
Accept Donations with PayPal <= 1.5.2 - Open Redirect
WordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability
28RIESGO
abrir ↗Nucleicritical
n8n - Remote Code Execution via Expression Injection
n8n Vulnerable to Remote Code Execution via Expression Injection
100RIESGO
abrir ↗Nucleihigh
Zimbra Collaboration - Local File Inclusion
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1
98RIESGO
abrir ↗Nucleihigh
phpMyFAQ - Configuration Backup Disclosure
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
36RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.