Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

79.107exploits catalogados
36.322CVEs con explotación pública
24.695probados en laboratorio
TodosExploit-DB 24.464Referência 22.936GitHub PoC 15.010VulnCheck XDB 8846Nuclei 4361Metasploit 3490✓ solo verificadosrecientespopularesriesgo
4361 exploits
Nucleihigh
Rocket TRUfusion Enterprise - Server Side Request Forgery
CVE-2025-32355HIGH
Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is
36RIESGO
abrir ↗
Nucleimedium
Vite - Path Traversal
CVE-2025-32395MEDIUM
Vite has an `server.fs.deny` bypass with an invalid `request-target`
28RIESGO
abrir ↗
Nucleicritical
XWiki Platform - SQL Injection
CVE-2025-32429CRITICAL
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
85RIESGO
abrir ↗
Nucleimedium
XWiki Platform - Cross-Site Scripting
CVE-2025-32430MEDIUM
XWiki Platform contains Reflected XSS vulnerability in two templates
28RIESGO
abrir ↗
Nucleicritical
CraftCMS - Remote Code Execution
CVE-2025-32432CRITICALbajo ataque
Craft CMS Allows Remote Code Execution
100RIESGO
abrir ↗
Nucleicritical
Langflow AI - Unauthenticated Remote Code Execution
CVE-2025-3248CRITICALbajo ataqueransomware
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RIESGO
abrir ↗
Nucleihigh
EventON Lite <= 2.4 - Authenticated Local File Inclusion
CVE-2025-32614HIGH
WordPress EventON plugin <= 2.4 - Local File Inclusion vulnerability
36RIESGO
abrir ↗
Nucleicritical
Web-Check < 2.0.1 Screenshot API - OS Command Injection
CVE-2025-32778CRITICAL
Web-Check allows command Injection via Unvalidated URL in Screenshot API
68RIESGO
abrir ↗
Nucleihigh
Infoblox NetMRI < 7.6.1 - Unauthenticated Command Injection in get_saml_request
CVE-2025-32813HIGH
An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.
48RIESGO
abrir ↗
Nucleicritical
NetMRI Unauthenticated SQL Injection via skipjackUsername
CVE-2025-32814CRITICAL
An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.
55RIESGO
abrir ↗
Nucleimedium
NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials
CVE-2025-32815MEDIUM
An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.
40RIESGO
abrir ↗
Nucleicritical
DataEase 2.10.4-2.10.7 - Remote Code Execution
CVE-2025-32966HIGH
Dataease H2 JDBC Connection Remote Code Execution
36RIESGO
abrir ↗
Nucleicritical
XWiki REST API Query - SQL Injection
CVE-2025-32969CRITICAL
org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
65RIESGO
abrir ↗
Nucleimedium
XWiki WYSIWYG API - Open Redirect
CVE-2025-32970MEDIUM
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
28RIESGO
abrir ↗
Nucleihigh
Karel IP Phone IP1211 Web Management Panel - Local File Inclusion
CVE-2025-34023HIGH
Karel IP Phone IP1211 Path Traversal
36RIESGO
abrir ↗
Nucleicritical
Versa Concerto Actuator Endpoint - Authentication Bypass
CVE-2025-34026CRITICALbajo ataque
Versa Concerto Actuator Authentication Bypass Information Leak
100RIESGO
abrir ↗
Nucleihigh
Casdoor - Authorization Bypass
CVE-2025-4210MEDIUM
Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization
28RIESGO
abrir ↗
Nucleimedium
Stop User Enumeration WordPress plugin - Authentication Bypass
CVE-2025-4302MEDIUM
Stop User Enumeration < 1.7.3 - Protection Bypass
28RIESGO
abrir ↗
Nucleicritical
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
CVE-2025-4322CRITICAL
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
68RIESGO
abrir ↗
Nucleicritical
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
CVE-2025-4334CRITICAL
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
63RIESGO
abrir ↗
Nucleicritical
Ads Pro Plugin <= 4.89 - Local File Inclusion
CVE-2025-4380HIGH
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion
48RIESGO
abrir ↗
Nucleimedium
Liferay Portal - Cross-Site Scripting
CVE-2025-4388MEDIUM
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024
28RIESGO
abrir ↗
Nucleihigh
Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection
CVE-2025-4396HIGH
Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection
56RIESGO
abrir ↗
Nucleimedium
MapTiler Tileserver-php v2.0 - Unauthenticated XSS
CVE-2025-44136CRITICAL
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an e
63RIESGO
abrir ↗
Nucleihigh
MapTiler Tileserver-php v2.0 - Unauthenticated File Read
CVE-2025-44137HIGH
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is resp
56RIESGO
abrir ↗
Nucleimedium
MailEnable Mail Service < v10 - Cross-Site Scripting
CVE-2025-44148CRITICAL
Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via
75RIESGO
abrir ↗
Nucleihigh
White Star Software ProTop - Directory Traversal
CVE-2025-44177HIGH
A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically
56RIESGO
abrir ↗
Nucleicritical
Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution
CVE-2025-4427MEDIUMbajo ataque
Authentication Bypass
100RIESGO
abrir ↗
Nucleihigh
WordPress Madara Theme < 2.2.2.1 - Local File Inclusion
CVE-2025-4524CRITICAL
Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion
68RIESGO
abrir ↗
Nucleimedium
Liferay Portal & DXP - Cross-Site Scripting
CVE-2025-4576MEDIUM
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025
28RIESGO
abrir ↗
← anteriorpágina 64 / 146siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.