What’s Vulnerable › Products

Rapid7 Nexpose vulnerabilities

21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your Rapid7 Nexpose version is affected

Latest Rapid7 Nexpose vulnerabilities

• CVE-2026-14172 — Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation (CVSS 7.8)
• CVE-2023-1699 — Rapid7 Nexpose Forced Browsing (CVSS 9.8)
• CVE-2022-3913 — Rapid7 Nexpose Certificate Validation Issue (CVSS 5.3)
• CVE-2022-4261 — Rapid7 Nexpose Update Validation Issue (CVSS 6.5)
• CVE-2022-0758 — Rapid7 Nexpose Reflected XSS (CVSS 6.1)
• CVE-2022-0757 — Rapid7 Nexpose SQL Injection (CVSS 8.8)
• CVE-2019-5640 — Rapid7 Nexpose Information Disclosure after logout (CVSS 5.3)
• CVE-2021-31868 — Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability (CVSS 5.4)
• CVE-2021-3535 — (CVSS 6.1)
• CVE-2020-7383 — SQL Injection in Rapid7 Nexpose (CVSS 8.1)
• CVE-2020-7382 — Unquoted Path in Rapid7 Nexpose Installer (CVSS 6.5)
• CVE-2020-7381 — Code Injection in Rapid7 Nexpose Installer (CVSS 7.8)
• CVE-2012-6494 — (CVSS 6.1)
• CVE-2019-5638 — Rapid7 Nexpose Insufficient Session Management (CVSS 6.8)
• CVE-2019-5630 — Rapid7 Nexpose/InsightVM Security Console CSRF (CVSS 8.8)
• CVE-2017-5264 — (CVSS 8.8)
• CVE-2017-5243 — (CVSS 8.5)
• CVE-2017-5232 — (CVSS 7.8)
• CVE-2017-5230 — (CVSS 7.2)
• CVE-2016-9757 — (CVSS 5.4)
• CVE-2012-6493 — (CVSS 6.8)