Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
71.760exploits catalogados
32.083CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 19.934GitHub PoC 13.235VulnCheck XDB 8150Nuclei 4193Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4193 exploits
Nucleimedium
Piwigo - User Enumeration via Password Reset
Piwigo Vulnerable to User Enumeration via Password Reset Endpoint
28RIESGO
abrir ↗Nucleimedium
Vite - Information Disclosure
vite allows server.fs.deny bypass via backslash on Windows
28RIESGO
abrir ↗Nucleimedium
VDO.Ninja - DOM-Based Cross-Site Scripting
VDO.Ninja Reflected XSS Vulnerability in control.html
28RIESGO
abrir ↗Nucleimedium
ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API
changedetection.io vulnerable to stored XSS in Watch update via API
23RIESGO
abrir ↗Nucleimedium
Dify v1.9.1 - Broken Access Control
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to th
41RIESGO
abrir ↗Nucleicritical
Code-Projects School Fees Payment System 1.0 - SQL Injection
code-projects School Fees Payment System student.php sql injection
28RIESGO
abrir ↗Nucleicritical
DNN - Unrestricted Arbitrary File Upload
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
75RIESGO
abrir ↗Nucleicritical
FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection
FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
100RIESGO
abrir ↗Nucleicritical
FortiWeb - Authentication Bypass
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
100RIESGO
abrir ↗Nucleihigh
Symfony HttpFoundation - Access Control Bypass via PATH_INFO
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
36RIESGO
abrir ↗Nucleimedium
Astro - Broken Access Control
Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass
28RIESGO
abrir ↗Nucleihigh
Astro - Reflected XSS via server islands feature
Astro is vulnerable to Reflected XSS via the server islands feature
36RIESGO
abrir ↗Nucleimedium
XWiki DeleteApplication - Cross-Site Scripting
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
28RIESGO
abrir ↗Nucleihigh
Apache Tika - XML External Entity Injection
Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
58RIESGO
abrir ↗Nucleihigh
Yonyou YonBIP - Path Traversal
In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to
36RIESGO
abrir ↗Nucleicritical
ComfyUI-Manager < 3.38 - Configuration Overwrite
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration a
36RIESGO
abrir ↗Nucleihigh
LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization
WordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerability
36RIESGO
abrir ↗Nucleimedium
User Submitted Posts <= 20251121 - Unauthenticated Open Redirect
WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability
28RIESGO
abrir ↗Nucleihigh
WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF
Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery
36RIESGO
abrir ↗Nucleimedium
Accept Donations with PayPal <= 1.5.2 - Open Redirect
WordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability
28RIESGO
abrir ↗Nucleicritical
n8n - Remote Code Execution via Expression Injection
n8n Vulnerable to Remote Code Execution via Expression Injection
100RIESGO
abrir ↗Nucleihigh
Zimbra Collaboration - Local File Inclusion
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1
98RIESGO
abrir ↗Nucleihigh
phpMyFAQ - Configuration Backup Disclosure
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
36RIESGO
abrir ↗Nucleicritical
The Opal Estate Pro – Property Management <= 1.7.5 - Unauthenticated Privilege Escalation
Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
68RIESGO
abrir ↗Nucleihigh
ionCube Tester Plus <= 1.3 - Local File Inclusion
WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability
36RIESGO
abrir ↗Nucleicritical
WordPress Events Manager <= 7.0.3 - SQL Injection
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
48RIESGO
abrir ↗Nucleihigh
WP Responsive Images <= 1.0 - Arbitrary File Read
WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src
36RIESGO
abrir ↗Nucleicritical
wpForo Forum <= 2.4.14 - SQL Injection
wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
56RIESGO
abrir ↗Nucleihigh
Ivanti Endpoint Manager - Authentication Bypass
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to
88RIESGO
abrir ↗Nucleimedium
LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write
LeadConnector < 3.0.22 - Unauthenticated Rest Call
28RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.