Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
84.600exploits catalogados
39.734CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.742Exploit-DB 24.486GitHub PoC 16.618VulnCheck XDB 9736Nuclei 4493Metasploit 3525✓ solo verificadosrecientespopularesriesgo
4493 exploits
Nucleihigh
LiteLLM - Arbitrary File Read
LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint
56RIESGO
abrir ↗Nucleihigh
Ech0 < 4.2.8 - Server-Side Request Forgery
Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata
56RIESGO
abrir ↗Nucleicritical
Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana
100RIESGO
abrir ↗Nucleihigh
FortiClient EMS - Authentication Bypass
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta
100RIESGO
abrir ↗Nucleihigh
Planyo Online Reservation System <= 3.0 - Arbitrary File Read
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
56RIESGO
abrir ↗Nucleicritical
WordPress Kali Forms <= 2.4.9 - Remote Code Execution
Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
63RIESGO
abrir ↗Nucleicritical
dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal
Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execut
43RIESGO
abrir ↗Nucleihigh
dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-u
36RIESGO
abrir ↗Nucleicritical
Breeze <= 2.4.4 - Arbitrary File Upload
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
63RIESGO
abrir ↗Nucleihigh
SeaweedFS <= 4.29 - Path Traversal File Write
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
56RIESGO
abrir ↗Nucleimedium
Etherpad 2.1.0 <= 3.0.0 - Cross-Site Scripting
Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)
28RIESGO
abrir ↗Nucleihigh
MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE
MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
36RIESGO
abrir ↗Nucleihigh
Gotenberg < 8.34.0 - Local File Disclosure
Gotenberg: SSRF via LibreOffice document processing
36RIESGO
abrir ↗Nucleicritical
Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE
Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
63RIESGO
abrir ↗Nucleicritical
Langflow < 1.9.1 - Unauthenticated File Upload
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
63RIESGO
abrir ↗Nucleimedium
Yamcs <=5.8.6 - Cross-Site Scripting
Yamcs: Reflected XSS in the URL of the Authorize Endpoint
28RIESGO
abrir ↗Nucleihigh
Yamcs <=5.11.12 - Arbitrary File Read
Yamcs: Unauthenticated Directory Traversal
36RIESGO
abrir ↗Nucleimedium
Dashy <= 4.3.6 - Reflected XSS via Workspace
Dashy: XSS in workspace url parameter
23RIESGO
abrir ↗Nucleicritical
Provectus kafka-ui <=0.7.2 - Remote Code Execution
provectus kafka-ui Endpoint testexecutions validateAccess code injection
48RIESGO
abrir ↗Nucleicritical
Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection
WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability
43RIESGO
abrir ↗Nucleimedium
VvvebJs <= 2.0.5 - Cross-Site Scripting
givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
48RIESGO
abrir ↗Nucleicritical
Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass
Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
43RIESGO
abrir ↗Nucleihigh
Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure
Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint
36RIESGO
abrir ↗Nucleicritical
Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
100RIESGO
abrir ↗Nucleicritical
Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
98RIESGO
abrir ↗Nucleicritical
AcyMailing < 10.11.1 - Unauthenticated SQL Injection
Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1
63RIESGO
abrir ↗Nucleihigh
9router <=0.5.4 - Authentication Bypass
9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
36RIESGO
abrir ↗Nucleicritical
Gorse < 0.5.10 - Unauthenticated Database Dump
Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints
63RIESGO
abrir ↗Nucleicritical
Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
56RIESGO
abrir ↗Nucleihigh
RabbitMQ Management - OAuth 2 Client Secret Disclosure
RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations
36RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.