Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
71.836exploits catalogados
32.133CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8156Nuclei 4201Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4201 exploits
Nucleihigh
Stirling-PDF SSRF via Markdown
Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf
36RIESGO
abrir ↗Nucleicritical
WeGIA - Directory Traversal
WeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'
43RIESGO
abrir ↗Nucleicritical
React Server Components - Remote Code Execution
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RIESGO
abrir ↗Nucleihigh
React Server Components - Denial of Service
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 1
68RIESGO
abrir ↗Nucleicritical
ArgoCD Project API Token Repository Credentials Exposure
Argo CD: Project API Token Exposes Repository Credentials
43RIESGO
abrir ↗Nucleimedium
Astro - Unauthorized Third-Party Image Access
Unauthorized third-party images in Astro’s _image endpoint
28RIESGO
abrir ↗Nucleihigh
Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download
An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory tr
23RIESGO
abrir ↗Nucleihigh
XWiki Platform - Information Disclosure
XWiki Platform's configuration files can be accessed through the webjars API
43RIESGO
abrir ↗Nucleihigh
XWiki Platform - Path Traversal
XWiki Platform's configuration files can be accessed through jsx and sx endpoints
43RIESGO
abrir ↗Nucleihigh
XWiki - Information Disclosure
The XWiki Jetty package (XJetty) allows accessing any application file through URL
36RIESGO
abrir ↗Nucleimedium
WSO2 Management Console - Authentication Bypass
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
28RIESGO
abrir ↗Nucleihigh
LiquidFiles < 4.2 - User Enumeration via Password Reset
LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The appli
56RIESGO
abrir ↗Nucleimedium
Avigilon ACM - Host Header Injection
A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplyin
43RIESGO
abrir ↗Nucleihigh
Dify v1.6.0 - Server-Side Request Forgery
Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_
28RIESGO
abrir ↗Nucleimedium
WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure
WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Sensitive Data Exposure vulnerability
28RIESGO
abrir ↗Nucleicritical
Squid Proxy - HTTP Authentication Credentials Disclosure
Squid vulnerable to information disclosure via authentication credential leakage in error handling
75RIESGO
abrir ↗Nucleimedium
Piwigo - User Enumeration via Password Reset
Piwigo Vulnerable to User Enumeration via Password Reset Endpoint
28RIESGO
abrir ↗Nucleimedium
Vite - Information Disclosure
vite allows server.fs.deny bypass via backslash on Windows
28RIESGO
abrir ↗Nucleimedium
VDO.Ninja - DOM-Based Cross-Site Scripting
VDO.Ninja Reflected XSS Vulnerability in control.html
28RIESGO
abrir ↗Nucleimedium
ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API
changedetection.io vulnerable to stored XSS in Watch update via API
23RIESGO
abrir ↗Nucleimedium
Dify v1.9.1 - Broken Access Control
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to th
41RIESGO
abrir ↗Nucleicritical
Code-Projects School Fees Payment System 1.0 - SQL Injection
code-projects School Fees Payment System student.php sql injection
28RIESGO
abrir ↗Nucleicritical
DNN - Unrestricted Arbitrary File Upload
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
75RIESGO
abrir ↗Nucleicritical
FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection
FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
100RIESGO
abrir ↗Nucleicritical
FortiWeb - Authentication Bypass
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
100RIESGO
abrir ↗Nucleihigh
Symfony HttpFoundation - Access Control Bypass via PATH_INFO
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
36RIESGO
abrir ↗Nucleimedium
Astro - Broken Access Control
Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass
28RIESGO
abrir ↗Nucleihigh
Astro - Reflected XSS via server islands feature
Astro is vulnerable to Reflected XSS via the server islands feature
36RIESGO
abrir ↗Nucleimedium
XWiki DeleteApplication - Cross-Site Scripting
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
28RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.