Explotación pública
Catálogo de exploits
Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.
71.836exploits catalogados
32.133CVEs con explotación pública
1932probados en laboratorio
TodosExploit-DB 22.786Referência 19.967GitHub PoC 13.264VulnCheck XDB 8156Nuclei 4201Metasploit 3462✓ solo verificadosrecientespopularesriesgo
4201 exploits
Nucleihigh
Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials
Sitecore XM and XP Hardcoded Credentials
48RIESGO
abrir ↗Nucleimedium
Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution
Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution
28RIESGO
abrir ↗Nucleihigh
Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks
56RIESGO
abrir ↗Nucleicritical
WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation
Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover
63RIESGO
abrir ↗Nucleicritical
Dell UnityVSA < 5.5 - Remote Command Injection
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
68RIESGO
abrir ↗Nucleihigh
Eveo URVE Web Manager - Server-Side Request Forgery
An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side
36RIESGO
abrir ↗Nucleicritical
HPE OneView - Remote Code Execution
A remote code execution issue exists in HPE OneView.
100RIESGO
abrir ↗Nucleihigh
MeteoBridge <= 6.1 - Remote Code Execution
Arbitrary Command Injection in Smartbedded MeteoBridge
88RIESGO
abrir ↗Nucleicritical
Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection
Unauthenticated Arbitrary Command Injection in Evertz SDVN
65RIESGO
abrir ↗Nucleihigh
SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass
SolarWinds Web Help Desk Security Control Bypass Vulnerability
100RIESGO
abrir ↗Nucleicritical
SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
95RIESGO
abrir ↗Nucleicritical
SolarWinds Web Help Desk - Authentication Bypass
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RIESGO
abrir ↗Nucleicritical
SolarWinds Web Help Desk - Authentication Bypass
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RIESGO
abrir ↗Nucleimedium
IceWarp Mail Server ≤11.4.0 - Open Redirect
Open redirection vulnerability in IceWarp Mail Server
28RIESGO
abrir ↗Nucleimedium
Wangshen SecGate 3600 Path Traversal Vulnerability
Wangshen SecGate 3600 g=log_export_file path traversal
28RIESGO
abrir ↗Nucleihigh
Grafana - XSS / Open Redirect / SSRF via Client Path Traversal
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
78RIESGO
abrir ↗Nucleimedium
Spring Framework - Path Traversal
CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers
28RIESGO
abrir ↗Nucleicritical
Spring Cloud Gateway Server Webflux - Broken Access Control
Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
63RIESGO
abrir ↗Nucleimedium
Ricoh Web Image Monitor - Reflected XSS
Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implem
28RIESGO
abrir ↗Nucleicritical
RevPi Webstatus <= v2.4.5 - Authentication Bypass
RevPi Webstatus application is vulnerable to an authentication bypass
75RIESGO
abrir ↗Nucleihigh
Casdoor - Authorization Bypass
Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization
28RIESGO
abrir ↗Nucleimedium
Stop User Enumeration WordPress plugin - Authentication Bypass
Stop User Enumeration < 1.7.3 - Protection Bypass
28RIESGO
abrir ↗Nucleicritical
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
68RIESGO
abrir ↗Nucleicritical
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
63RIESGO
abrir ↗Nucleicritical
Ads Pro Plugin <= 4.89 - Local File Inclusion
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion
41RIESGO
abrir ↗Nucleimedium
Liferay Portal - Cross-Site Scripting
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024
28RIESGO
abrir ↗Nucleihigh
Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection
Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection
56RIESGO
abrir ↗Nucleimedium
MapTiler Tileserver-php v2.0 - Unauthenticated XSS
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an e
63RIESGO
abrir ↗Nucleihigh
MapTiler Tileserver-php v2.0 - Unauthenticated File Read
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is resp
56RIESGO
abrir ↗Nucleimedium
MailEnable Mail Service < v10 - Cross-Site Scripting
Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via
75RIESGO
abrir ↗Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.