The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
Red Hat: CVE-2026-111079: goose: goose: Shell History and Environment Leak via Terminal Integration7.4 HighN/A0%Oct 22, 2026
CVE-2025-71434: Weaver Network Co., Ltd. E-cology: Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the…8.2 High8.8 High0%Oct 22, 2026
CVE-2024-58396: YouDataSum CPAS Audit Management System: YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated…7.5 High8.7 High0%Oct 22, 2026
CVE-2024-58394: Retool: Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute…6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2024-58393: i-Netsolution Readymade Unilevel Ecommerce MLM: i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows…8.2 High8.8 High0%Oct 22, 2026
CVE-2023-54413: OnTheGoSystems WPML Multilingual CMS: WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that…6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2022-51025: Penta Security Systems WAPPLES: Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated…6.5 Medium7.1 High0%Oct 22, 2026
CVE-2022-51024: Kareadita Kavita: Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read…7.5 High8.7 High0%Oct 22, 2026
CVE-2022-51023: PHPOK: PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to…8.2 High8.8 High0%Oct 22, 2026
CVE-2022-51022: liukuo362573 YiShaAdmin: YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the…9.1 Critical8.8 High1%Oct 22, 2026
CVE-2022-51021: WPDeveloper NotificationX: NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that…8.2 High8.8 High0%Oct 22, 2026
CVE-2021-48017: OrbiTeam BSCW Server: OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in…7.5 High8.7 High0%Oct 22, 2026
CVE-2021-48016: DedeCMS: DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is…9.8 Critical9.3 Critical0%Oct 22, 2026
CVE-2021-48015: erzhongxmu JeeWMS: JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to…7.5 High8.7 High1%Oct 22, 2026
CVE-2021-48014: FanRuan FineReport: FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that…9.8 Critical9.3 Critical2%Oct 22, 2026
CVE-2021-48013: Weaver Network Co., Ltd. E-cology: Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary…7.5 High8.7 High1%Oct 22, 2026
CVE-2020-37284: midgetspy Sickbeard: Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated…6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2019-25779: WooThemes Diarise: WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read…7.5 High8.7 High0%Oct 22, 2026
CVE-2019-25778: SeaCMS: SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate…8.2 High8.8 High0%Oct 22, 2026
CVE-2018-25439: MetInfo: MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows…7.5 High8.7 High0%Oct 22, 2026
CVE-2018-25438: Intermesh Group-Office: Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that…7.5 High8.7 High1%Oct 22, 2026
CVE-2017-20290: Discourse: Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows…6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2017-20289: Broadstreet Ad Widget: Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that…7.5 High7.7 High1%Oct 22, 2026
CVE-2017-20288: QCubed: QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated…6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2017-20287: Javo Themes Javo Spot: Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated…7.5 High8.7 High0%Oct 22, 2026
876-900 of 530113
‹›