What’s Vulnerable › Vulnerabilities

CVE-2022-0757: Rapid7 Nexpose SQL Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-17 · updated 2026-06-17
• Weakness: CWE-89

Description

Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined. This lack of validation can allow a logged-in, authenticated attacker to manipulate the "ANY" and "OR" operators in the SearchCriteria and inject SQL code. This issue was fixed in Rapid7 Nexpose version 6.6.129.

Affected products

• Rapid7 Nexpose: through 6.6.93

References

• https://docs.rapid7.com/release-notes/nexpose/20220302/
• https://docs.rapid7.com/release-notes/nexpose/20220302/

Get alerted when CVE-2022-0757 or the next vulnerability affects your stack