Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
71.836exploits catalogados
32.133CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8156Nuclei 4201Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4201 exploits
Nucleihigh
Palo Alto Expedition - SQL Injection
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
100RIESGO
abrir ↗Nucleihigh
PAN-OS Management Web Interface - Command Injection
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
100RIESGO
abrir ↗Nucleihigh
Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution
Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution
61RIESGO
abrir ↗Nucleicritical
Four-Faith F3x36 - Authentication Bypass
Four-Faith F3x36 Hidden Debug Credentials
43RIESGO
abrir ↗Nucleicritical
Hunk Companion <= 1.8.4 - Arbitrary Plugin Installation
Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
63RIESGO
abrir ↗Nucleimedium
EKC Tournament Manager WordPress plugin - Path Traversal
EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability
28RIESGO
abrir ↗Nucleihigh
WordPress UIX Shortcodes <= 1.9.7 - Unauthenticated Shortcode Execution
Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution
36RIESGO
abrir ↗Nucleicritical
WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection
WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection
28RIESGO
abrir ↗Nucleihigh
HuangDou UTCMS V9 - OS Command Injection
HuangDou UTCMS cli.php os command injection
50RIESGO
abrir ↗Nucleihigh
PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download
PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download
36RIESGO
abrir ↗Nucleicritical
Crypto <= 2.15 - Authentication Bypass
Crypto <= 2.18 - Authentication Bypass via log_in
43RIESGO
abrir ↗Nucleicritical
Palo Alto Networks Expedition - OS Command Injection
Expedition: OS Command Injection Vulnerability
58RIESGO
abrir ↗Nucleicritical
PAN-OS Management Interface - Path Confusion to Authentication Bypass
PAN-OS: Authentication Bypass in the Management Web Interface
100RIESGO
abrir ↗Nucleimedium
PAN-OS - Reflected Cross-Site Scripting
PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal
35RIESGO
abrir ↗Nucleicritical
WP Directory Kit <= 1.4.4 - Authentication Bypass
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
63RIESGO
abrir ↗Nucleimedium
Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting
Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting
28RIESGO
abrir ↗Nucleicritical
Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
85RIESGO
abrir ↗Nucleihigh
IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure
IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function
36RIESGO
abrir ↗Nucleicritical
WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection
CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter
28RIESGO
abrir ↗Nucleicritical
WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution
Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution
43RIESGO
abrir ↗Nucleihigh
Yoco Payments <= 3.8.8 - Path Traversal
Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read
36RIESGO
abrir ↗Nucleimedium
WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure
WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action
28RIESGO
abrir ↗Nucleimedium
LearnPress < 4.3.2 - Broken Access Control
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
28RIESGO
abrir ↗Nucleihigh
Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection
Team < 5.0.11 - Unauthenticated SQLi
36RIESGO
abrir ↗Nucleimedium
Premium Addons for Elementor - Unauthenticated Information Disclosure
Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'
28RIESGO
abrir ↗Nucleihigh
Payara Server - Cross-Site Scripting
Admin Account Takeover via malicious URL payload
36RIESGO
abrir ↗Nucleihigh
WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File
Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
36RIESGO
abrir ↗Nucleihigh
D-Link DIR-803 - Authentication Bypass
D-Link DIR-803 Configuration getcfg.php information disclosure
28RIESGO
abrir ↗Nucleicritical
Gladinet CentreStack & Triofox - Hardcoded Credentials
Gladinet CentreStack and TrioFox Hard Coded AES Keys
98RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.