Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.600exploits catalogados
39.734CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.742Exploit-DB 24.486GitHub PoC 16.618VulnCheck XDB 9736Nuclei 4493Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4493 exploits
Nucleimedium
WSO2 Management Console - Authentication Bypass
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
28RIESGO
abrir ↗Nucleihigh
LiquidFiles < 4.2 - User Enumeration via Password Reset
LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The appli
56RIESGO
abrir ↗Nucleimedium
Avigilon ACM - Host Header Injection
A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplyin
43RIESGO
abrir ↗Nucleihigh
Dify v1.6.0 - Server-Side Request Forgery
Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_
28RIESGO
abrir ↗Nucleicritical
Datart v1.0.0-rc.3 - Remote Code Execution
An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.
63RIESGO
abrir ↗Nucleicritical
HyperComments <= 1.2.2 - Arbitrary Options Update
HyperComments <= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Update
36RIESGO
abrir ↗Nucleihigh
Docmost 0.2.1-0.21.0 - Arbitrary File Read
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local file
56RIESGO
abrir ↗Nucleicritical
Citrix NetScaler Memory Disclosure - CitrixBleed 2
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RIESGO
abrir ↗Nucleimedium
Commvault Unauthenticated Password Disclosure (WT-2025-0047)
Unauthorized API Access Risk
28RIESGO
abrir ↗Nucleimedium
Commvault Initial Administrator Login Process Vulnerability
Vulnerability in Initial Administrator Login Process
28RIESGO
abrir ↗Nucleihigh
ESPHome - Authentication Bypass
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
36RIESGO
abrir ↗Nucleicritical
FreePBX - Remote Code Execution
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RIESGO
abrir ↗Nucleimedium
Next.js Middleware - Server-Side Request Forgery
Next.js Improper Middleware Redirect Handling Leads to SSRF
28RIESGO
abrir ↗Nucleimedium
JumpServer - Open Redirect via Referer Header
JumpServer has an Open Redirect Vulnerability
28RIESGO
abrir ↗Nucleihigh
Astro Cloudflare Adapter - Server Side Request Forgery
Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint
36RIESGO
abrir ↗Nucleimedium
WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure
WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.16.16 - Sensitive Data Exposure Vulnerability
28RIESGO
abrir ↗Nucleimedium
Trinity Audio <= 5.21.0 - Information Exposure
Trinity Audio <= 5.21.0 - Unauthenticated Information Exposure
28RIESGO
abrir ↗Nucleicritical
RestroPress 3.0.0-3.2.1 - Authentication Bypass
RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
63RIESGO
abrir ↗Nucleimedium
N-central - Authentication Bypass
N-central unauthenticated sessionID generation
60RIESGO
abrir ↗Nucleicritical
Loan Management System 1.0 - SQL Injection
Campcodes Online Loan Management System ajax.php sql injection
28RIESGO
abrir ↗Nucleimedium
The Events Calendar <= 6.15.2 - Information Disclosure
The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
28RIESGO
abrir ↗Nucleimedium
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
33RIESGO
abrir ↗Nucleicritical
MLflow Job API - Authentication Bypass
Missing Authentication for Critical Function in mlflow/mlflow
36RIESGO
abrir ↗Nucleicritical
LolLMS <= 2.2.0 - Unauthenticated File Upload
Unauthenticated File Upload in parisneo/lollms
36RIESGO
abrir ↗Nucleihigh
LolLMS < 2.2.0 - Server-Side Request Forgery
Server-Side Request Forgery (SSRF) in parisneo/lollms
36RIESGO
abrir ↗Nucleimedium
Shield Security <= 21.0.8 - Unauthenticated Reflected XSS
Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter
28RIESGO
abrir ↗Nucleimedium
WordPress List Site Contributors < 1.1.8 - Reflected XSS
List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha
28RIESGO
abrir ↗Nucleicritical
OpenFlagr <= 1.1.18 - Authentication Bypass
OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization
43RIESGO
abrir ↗Nucleihigh
BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass
BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation
36RIESGO
abrir ↗Nucleihigh
VidShop for WooCommerce <= 1.1.4 - SQL Injection
VidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'
36RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.