Rapid7 Metasploit Framework server request forgery vulnerability

Versions of the Rapid7 Metasploit Framework prior to 6.5.7 contain a server-side request forgery vulnerability. This vulnerability arises because the FTP client trusts the IP address and port specified in the server’s PASV response without verification. A malicious FTP server can specify any...

cve-threat-intelligence-hub

cve · threat-intelligence · vulnerabilities · cisa-kev · epss ·...

CVE-2026-7373

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a stat...

EUVD-2026-30498

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows host. Upon startup the metasploitPostgreSQL service the subsequent postgres.exe service attempts to load an OpenSSL configuration file from a non-existent directo...

CVE-2026-7373: Inclusion of Functionality from Untrusted Control Sphere

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a stat...

EUVD-2020-28481

Malware in sbrugna...

EUVD-2017-6553

Malware in sbrugna...

EUVD-2017-14333

Malware in sbrugna...

EUVD-2017-14334

Malware in sbrugna...

EUVD-2017-14336

Malware in sbrugna...

EUVD-2017-14340

Malware in sbrugna...

EUVD-2019-15199

Malware in sbrugna...

EUVD-2020-28482

Malware in sbrugna...

EUVD-2023-12637

Malicious code in bioql PyPI...

CVE-2017-15084

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

CVE-2023-0599

Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another...

CVE-2023-0599 Rapid7 Metasploit Pro Stored XSS

Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another...

Rapid7 Metasploit Pro Cross-Site Script Vulnerabilities

Rapid7 Metasploit Pro is a suite of penetration testing software from the US-based Rapid7. A security vulnerability exists in Rapid7 Metasploit Pro 4.21.2 and prior versions, which stems from insufficient JavaScript request string cleanup, and can be exploited by an attacker to execute HTML and...

CVE-2023-0599: Improper Neutralization of Input During Web Page Generation

Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another...

Rapid7 Metasploit security vulnerabilities

Rapid7 Metasploit is a suite of penetration testing software from the US-based company Rapid7. Rapid7 Metasploit suffers from a security vulnerability that stems from its use of the Remote Mouse Server protocol to deploy a payload and run it from a server, a module that only deploys a payload if...