Rapid7 Nexpose
22 CVEs affecting Rapid7 Nexpose. Latest disclosed: 2026-07-24. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-5264 | High | 8.8 | 2017-12-14 | Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application… |
CVE-2019-5638 | High | 8.7 | 2019-08-21 | Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, lo… |
CVE-2017-5243 | High | 8.5 | 2017-06-06 | The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other imp… |
CVE-2026-14172 | High | 7.8 | 2026-07-24 | Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a l… |
CVE-2017-5232 | High | 7.8 | 2017-03-02 | All editions of Rapid7 Nexpose installers prior to version 6.4.24 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a ma… |
CVE-2017-5230 | High | 7.2 | 2017-03-02 | The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiabl… |
CVE-2020-7382 | Medium | 6.8 | 2020-09-03 | Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file… |
CVE-2020-7383 | Medium | 6.5 | 2020-10-14 | A SQL Injection issue in Rapid7 Nexpose version prior to 6.6.49 that may have allowed an authenticated user with a low permission level to access resources & m… |
CVE-2012-6494 | Medium | 6.1 | 2020-01-25 | Rapid7 Nexpose before 5.5.4 contains a session hijacking vulnerability which allows remote attackers to capture a user's session and gain unauthorized access. |
CVE-2019-5630 | Medium | 5.9 | 2019-07-03 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attac… |
CVE-2020-7381 | Medium | 5.8 | 2020-09-03 | In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker… |
CVE-2022-0757 | Medium | 5.5 | 2022-03-17 | Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined. This lack of vali… |
CVE-2016-9757 | Medium | 5.4 | 2016-12-20 | In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site… |
CVE-2022-3913 | Medium | 5.3 | 2023-02-01 | Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could… |
CVE-2022-4261 | Medium | 4.4 | 2022-12-08 | Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to… |
CVE-2023-1699 | Medium | 4.3 | 2023-03-30 | Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability. This vulnerability allows an attacker to manipulate URLs to forcefully… |
CVE-2023-0681 | Medium | 4.3 | 2023-03-20 | Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of… |
CVE-2021-31868 | Medium | 4.3 | 2021-08-19 | Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regar… |
CVE-2021-3535 | Medium | 4.3 | 2021-06-16 | Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific… |
CVE-2022-0758 | Low | 3.3 | 2022-03-17 | Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cross site scripting vulnerability, within the shared scan configuration component of the t… |