Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

71.760exploits catalogados
32.083CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 19.934GitHub PoC 13.235VulnCheck XDB 8150Nuclei 4193Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4193 exploits
Nucleicritical
EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution
CVE-2025-34035CRITICAL
EnGenius EnShare IoT Gigabit Cloud Service Command Injection
68RIESGO
abrir ↗
Nucleihigh
Fanwei e-cology - SQL Injection
CVE-2025-34038HIGH
Weaver E-cology SQL Injection
36RIESGO
abrir ↗
Nucleicritical
Zhiyuan OA Platform - Arbitrary File Upload
CVE-2025-34040CRITICAL
Seeyon Zhiyuan OA System Path Traversal File Upload
68RIESGO
abrir ↗
Nucleihigh
WeiPHP 5.0 - Path Traversal
CVE-2025-34045HIGH
WeiPHP Path Traversal Arbitrary File Read
36RIESGO
abrir ↗
Nucleicritical
Maltrail <=0.54 Username Parameter - Remote Command Execution
CVE-2025-34073CRITICAL
stamparm/maltrail <=0.54 Remote Command Execution
63RIESGO
abrir ↗
Nucleicritical
WordPress Pie Register <= 3.7.1.4 - Authentication Bypass
CVE-2025-34077CRITICAL
WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE
63RIESGO
abrir ↗
Nucleicritical
WordPress Simple File List <=4.2.2 - Remote Code Execution
CVE-2025-34085—
35RIESGO
abrir ↗
Nucleimedium
ETQ Reliance - Reflected XSS via SQLConverterServlet
CVE-2025-34141MEDIUM
ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`
28RIESGO
abrir ↗
Nucleicritical
ETQ Reliance - Authentication Bypass via Trailing Space
CVE-2025-34143CRITICAL
ETQ Reliance CG Authentication Bypass via Trailing Space RCE
48RIESGO
abrir ↗
Nucleimedium
Grafana - Exposes DingDing API Keys
CVE-2025-3415MEDIUM
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not p
28RIESGO
abrir ↗
Nucleicritical
Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter
CVE-2025-34152CRITICAL
Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter
75RIESGO
abrir ↗
Nucleicritical
Langflow AI <= 1.6.9 - CORS Misconfiguration
CVE-2025-34291CRITICALbajo ataque
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
100RIESGO
abrir ↗
Nucleicritical
Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution
CVE-2025-34299CRITICAL
Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload
85RIESGO
abrir ↗
Nucleihigh
YesWiki Reflected XSS via File Upload
CVE-2025-46349HIGH
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
36RIESGO
abrir ↗
Nucleimedium
Broadstreet WordPress plugin - Reflected XSS
CVE-2025-4652MEDIUM
Broadstreet < 1.51.8 - Reflected XSS
28RIESGO
abrir ↗
Nucleimedium
YesWiki <= 4.5.1 - Cross-Site Scripting
CVE-2025-46549MEDIUM
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
28RIESGO
abrir ↗
Nucleimedium
YesWiki < 4.5.4 - Cross-Site Scripting
CVE-2025-46550MEDIUM
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
28RIESGO
abrir ↗
Nucleihigh
XWiki REST API - Attachments Disclosure
CVE-2025-46554MEDIUM
XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API
28RIESGO
abrir ↗
Nucleimedium
Vite Dev Server - Information Exposure
CVE-2025-46565MEDIUM
Vite's server.fs.deny bypassed with /. for files under project root
28RIESGO
abrir ↗
Nucleihigh
Java-springboot-codebase 1.1 - Arbitrary File Read
CVE-2025-46822HIGH
Unauthenticated Arbitrary File Read via Absolute Path
56RIESGO
abrir ↗
Nucleicritical
Mitel 6000 - OS Command Injection
CVE-2025-47188MEDIUM
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and th
40RIESGO
abrir ↗
Nucleimedium
Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting
CVE-2025-47204MEDIUM
An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the sour
28RIESGO
abrir ↗
Nucleihigh
Personal Weather Station Dashboard 12 - Directory Traversal
CVE-2025-47423MEDIUM
Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ direct
28RIESGO
abrir ↗
Nucleihigh
WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download
CVE-2025-47445HIGH
WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability
36RIESGO
abrir ↗
Nucleicritical
Eventin <= 4.0.26 - Privilege Escalation
CVE-2025-47539CRITICAL
WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability
75RIESGO
abrir ↗
Nucleihigh
TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload
CVE-2025-47577CRITICAL
WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability
63RIESGO
abrir ↗
Nucleicritical
PSW Front-end Login & Registration 1.13 - Weak Password Recovery
CVE-2025-47646CRITICAL
WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability
68RIESGO
abrir ↗
Nucleimedium
Label Studio < 1.18.0 - Reflected XSS
CVE-2025-47783HIGH
label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.
36RIESGO
abrir ↗
Nucleicritical
Wing FTP Server <= 7.4.3 - Remote Code Execution
CVE-2025-47812CRITICALbajo ataque
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection o
100RIESGO
abrir ↗
Nucleimedium
Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie
CVE-2025-47813MEDIUMbajo ataque
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a
70RIESGO
abrir ↗
← anteriorpágina 82 / 140siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.