CVE & Exploit Intelligence Database

Updated 54m ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

337,123 CVEs tracked 53,219 with exploits 4,686 exploited in wild 1,539 CISA KEV 3,912 Nuclei templates 37,757 vendors 42,422 researchers

27 results Clear all

CVE-2025-32821 7.2 HIGH EPSS 0.01

Sonicwall Sma 100 Firmware < 10.2.1.15-81sv - OS Command Injection

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance.

CWE-78 May 07, 2025

CVE-2025-32820 8.8 HIGH EPSS 0.01

Sonicwall Sma 100 Firmware < 10.2.1.15-81sv - Path Traversal

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance writable.

CWE-22 May 07, 2025

CVE-2025-32819 8.8 HIGH EXPLOITED EPSS 0.01

Sonicwall Sma 100 Firmware < 10.2.1.15-81sv - Path Traversal

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.

CWE-552 May 07, 2025

CVE-2024-53703 8.1 HIGH 1 PoC Analysis EPSS 0.29

Sonicwall Sma 200 Firmware < 10.2.1.14-75sv - Stack Buffer Overflow

A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.

CWE-121 Dec 05, 2024

CVE-2024-53702 5.3 MEDIUM EPSS 0.00

SonicWall SMA100 - Info Disclosure

Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret.

CWE-338 Dec 05, 2024

CVE-2024-45319 6.3 MEDIUM EPSS 0.01

SonicWall SMA100 SSLVPN <10.2.1.13-72sv - Auth Bypass

A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certificate requirement during authentication.

CWE-798 Dec 05, 2024

CVE-2024-45318 8.1 HIGH EPSS 0.02

SonicWall SMA100 - Buffer Overflow

A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.

CWE-121 Dec 05, 2024

CVE-2024-40763 7.5 HIGH EPSS 0.08

SonicWall SMA100 - Buffer Overflow

Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-based buffer overflow and potentially lead to code execution.

CWE-122 Dec 05, 2024

CVE-2024-38475 9.1 CRITICAL KEV 5 PoCs Analysis NUCLEI EPSS 0.93

Apache HTTP Server <2.4.59 - RCE

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

CWE-116 Jul 01, 2024

CVE-2024-22395 6.3 MEDIUM EPSS 0.00

SMA100 - Privilege Escalation

Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application.

CWE-287 Feb 24, 2024

CVE-2023-5970 8.8 HIGH EXPLOITED EPSS 0.00

Sonicwall Sma 200 Firmware < 10.2.1.9-57sv - Authentication Bypass

Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external domain user using accent characters, resulting in an MFA bypass.

CWE-287 Dec 05, 2023

CVE-2023-44221 7.2 HIGH KEV EPSS 0.22

Sonicwall Sma 200 Firmware < 10.2.1.9-57sv - OS Command Injection

Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.

CWE-78 Dec 05, 2023

CVE-2022-2915 8.8 HIGH EXPLOITED EPSS 0.01

Sonicwall Sma 200 Firmware < 10.2.1.5-34sv - Out-of-Bounds Write

A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the appliance or potentially lead to code execution. This vulnerability impacts 10.2.1.5-34sv and earlier versions.

CWE-122 Aug 26, 2022

CVE-2022-22273 9.8 CRITICAL EPSS 0.01

Secure Remote Access <8 - OS Command Injection

Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions

CWE-78 Mar 17, 2022

CVE-2021-20050 7.5 HIGH EPSS 0.00

Sonicwall Sma 100 Firmware < 10.0.0.0 - Improper Access Control

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data.

CWE-284 Dec 23, 2021

CVE-2021-20049 7.5 HIGH EPSS 0.00

Sonicwall Sma 100 Firmware < 10.0.0.0 - Information Disclosure

A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions.

CWE-204 Dec 23, 2021

CVE-2021-20045 9.8 CRITICAL EPSS 0.04

Sonicwall Sma 200 Firmware - Buffer Overflow

A buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a remote unauthenticated attacker to potentially execute code as the 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

CWE-120 Dec 08, 2021

CVE-2021-20044 8.8 HIGH EPSS 0.06

Sonicwall Sma 200 Firmware - OS Command Injection

A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

CWE-78 Dec 08, 2021

CVE-2021-20043 8.8 HIGH EPSS 0.05

Sonicwall Sma 200 Firmware - Out-of-Bounds Write

A Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a remote authenticated attacker to potentially execute code as the nobody user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

CWE-122 Dec 08, 2021

CVE-2021-20042 9.8 CRITICAL EPSS 0.01

An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.

CWE-441 Dec 08, 2021