Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
71.836exploits catalogados
32.133CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8156Nuclei 4201Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4201 exploits
Nucleicritical
MyStyle Custom Product Designer <= 3.21.1 - SQL Injection
WordPress MyStyle Custom Product Designer plugin <= 3.21.1 - SQL Injection Vulnerability
43RIESGO
abrir ↗Nucleicritical
CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell
100RIESGO
abrir ↗Nucleicritical
vBulletin 5.0.0-6.0.3 - Authentication Bypass
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'
85RIESGO
abrir ↗Nucleicritical
vBulletin replaceAdTemplate - Remote Code Execution
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the t
75RIESGO
abrir ↗Nucleihigh
Discourse OAuth Social Login - Cross-site Scripting
Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow
36RIESGO
abrir ↗Nucleicritical
DataEase < 2.10.10 - JWT Authentication Bypass
Dataease Authentication Bypass Vulnerability
41RIESGO
abrir ↗Nucleihigh
DataEase - Remote Code Execution
Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
48RIESGO
abrir ↗Nucleihigh
WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution
WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability
63RIESGO
abrir ↗Nucleicritical
Roundcube Webmail - Remote Code Execution
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the
100RIESGO
abrir ↗Nucleicritical
Pterodactyl Panel - Remote Code Execution
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
68RIESGO
abrir ↗Nucleicritical
Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)
Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
48RIESGO
abrir ↗Nucleicritical
Adobe Experience Manager Forms - Insecure Deserialization
Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)
55RIESGO
abrir ↗Nucleicritical
MCP Inspector < 0.14.0 UnauthenticatedRemote Code Execution
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
75RIESGO
abrir ↗Nucleimedium
Microsoft SharePoint Server - Authentication Bypass
Microsoft SharePoint Server Spoofing Vulnerability
100RIESGO
abrir ↗Nucleicritical
Teleport - Authentication Bypass
Teleport allows remote authentication bypass
43RIESGO
abrir ↗Nucleimedium
Heimdall - Host Header Injection & Open Redirect
LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically
43RIESGO
abrir ↗Nucleicritical
Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization
Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
95RIESGO
abrir ↗Nucleihigh
Letta Letta 0.7.12 - Remote Code Execution
Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows rem
56RIESGO
abrir ↗Nucleimedium
Microweber CMS2.0 - Cross-Site Scripting
Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS
28RIESGO
abrir ↗Nucleimedium
Microweber CMS 2.0 - Reflected XSS in Admin Page Creation
Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allow
28RIESGO
abrir ↗Nucleimedium
PrestaShop - Information Disclosure
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers
23RIESGO
abrir ↗Nucleimedium
XWiki – Stored Cross-Site Scripting (XSS)
XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administra
28RIESGO
abrir ↗Nucleicritical
XWiki <= 17.3.0 - Server-Side Template Injection (SSTI)
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, spe
36RIESGO
abrir ↗Nucleicritical
MikoPBX - Unrestricted File Upload
PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbit
43RIESGO
abrir ↗Nucleihigh
XWiki - HQL Injection
XWiki Platform vulnerable to HQL injection via wiki and space search REST API
43RIESGO
abrir ↗Nucleihigh
DNN (DotNetNuke) - Unicode Path Normalization NTLM Hash Disclosure
DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input
68RIESGO
abrir ↗Nucleicritical
UniFi Access - Broken Access Control
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access applicat
55RIESGO
abrir ↗Nucleicritical
Advantech WISE-IoTSuite/SaaS - SQL Injection
Execution of arbitrary SQL commands
75RIESGO
abrir ↗Nucleihigh
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
56RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.