Metasploit

This hub aggregates every CVE we track for Metasploit, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Metasploit.

• CVE-2023-0599Rapid7 Metasploit Pro Stored XSS6.1Feb 1, 2023
• CVE-2020-7385Metasploit Framework 'drb_remote_codeexec' code execution8.1Apr 23, 2021
• CVE-2020-7384Client-Side Command Injection in Rapid7 Metasploit7.0Oct 29, 2020
• CVE-2019-5645Rapid7 Metasploit HTTP Handler Denial of Service7.5Sep 1, 2020
• CVE-2020-7377Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module8.1Aug 24, 2020
• CVE-2020-7376Rapid7 Metasploit Framework Relative Path Traversal in enum_osx module7.1Aug 24, 2020
• CVE-2020-7355Rapid7 Metasploit Pro Stored XSS in 'notes' field6.1Jun 25, 2020
• CVE-2020-7354Rapid7 Metasploit Pro Stored XSS in 'host' field6.1Jun 25, 2020
• CVE-2020-7350Metasploit Framework Plugin Libnotify Command Injection6.1Apr 22, 2020
• CVE-2019-5642MAGICK3.3Nov 6, 2019
• CVE-2019-5624Rapid7 Metasploit Framework Zip Import Directory Traversal7.3Apr 30, 2019
• CVE-2017-15084The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22.6.5Oct 6, 2017
• CVE-2017-5244Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of...3.5Jun 15, 2017
• CVE-2017-5235Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current w...7.8Mar 2, 2017
• CVE-2017-5231All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. By using a spec...7.1Mar 2, 2017