Sploitus

217 exploited vulnerabilities in Apache Http Server

Showing 1–50 of 217, highest-scoring first

Vendors
Apache, Linux Mint, Red Os, Rocky Linux, Canonical, Alt Linux
With known exploits
217
Affected Apache Http Server versions
< 2.4.67, 2.4.60, 2.4.61, 2.4.62, 2.4.55, 2.4.52, 2.4.49, 2.4.50, 2.4.43, 2.4.54, 2.2.33, 2.4.26, 2.2.0, 2.2.2, 2.2.3, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15, 2.2.16, 2.2.17, 2.2.18, 2.2.19, 2.2.20, 2.2.21, 2.2.22, 2.2.23, 2.2.24, 2.2.25, 2.2.26, 2.2.27, 2.2.29, 2.2.30, 2.2.31, 2.2.32, 2.4.1, 2.4.2, 2.4.10, 2.4.12, 2.4.16, 2.4.17, 2.4.18, 2.4.20, 2.4.23, 2.4.25, 2.4.64, 2.4.39, 2.4.66, 2.4.56
Affected Gnu Bash versions
≤ 4.3
Affected Ibm Websphere Application Server versions
< 6.1.0.31
Affected Openssl versions
≤ 0.9.8l, 0.9.1c, 0.9.2b, 0.9.3, 0.9.3a, 0.9.4, 0.9.5, 0.9.5a, 0.9.6, 0.9.6a, 0.9.6b, 0.9.6c, 0.9.6d, 0.9.6e, 0.9.6f, 0.9.6g, 0.9.6h, 0.9.6i, 0.9.6j, 0.9.6k, 0.9.6l, 0.9.6m, 0.9.7, 0.9.7a, 0.9.7b, 0.9.7c, 0.9.7d, 0.9.7e, 0.9.7f, 0.9.7g, 0.9.7h, 0.9.7i, 0.9.7j, 0.9.7k, 0.9.7l, 0.9.7m, 0.9.8, 0.9.8a, 0.9.8b, 0.9.8c, 0.9.8k, 1.0
Affected Apache Apr-util versions
= 0.9.1, 0.9.2, 0.9.2-dev, 0.9.3, 0.9.3-dev, 0.9.4, 0.9.5, 0.9.6, 0.9.7-dev, 0.9.8, 0.9.9, 0.9.16, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.4-dev, 1.3.5, 1.3.6, 1.3.6-dev, 1.3.7, 1.3.8
Affected Apache Portable Runtime versions
= 0.9.1, 0.9.2, 0.9.2-dev, 0.9.3, 0.9.3-dev, 0.9.4, 0.9.5, 0.9.6, 0.9.7, 0.9.7-dev, 0.9.8, 0.9.9, 0.9.16-dev, 1.3.0, 1.3.1, 1.3.2, 1.3.3
Affected Sonicwall Sma 200 Firmware versions
= 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv
Affected Vbulletin versions
≤ 5.3.3, 5.0.0

Vulnerabilities with exploits

Highest CVSS first — 27 of these already have exploit code on Sploitus

CVE-2026-29168
CVSS 10.0 HIGH 2026-03-02FIX AVAILABLE
CVE-2026-28780
CVSS 10.0 CRITICAL 2026-02-04FIX AVAILABLE
CVE-2024-38474
CVSS 10.0 CRITICAL 2024-07-01FIX AVAILABLE
CVE-2024-40725 3 exploits
CVSS 10.0 HIGH 2024-07-09FIX AVAILABLE
Exploit for Exposure of Resource to Wrong Sphere in Apache Http_ServerExploit for Exposure of Resource to Wrong Sphere in Apache Http_Server
CVE-2024-40898 5 exploits
CVSS 10.0 CRITICAL 2024-07-17FIX AVAILABLE
Exploit for Exposure of Resource to Wrong Sphere in Apache Http_ServerExploit for Server-Side Request Forgery in Apache Http_Server
CVE-2024-38476
CVSS 10.0 CRITICAL 2024-07-01FIX AVAILABLE
CVE-2023-25690 5 exploits
CVSS 10.0 CRITICAL 2022-11-08FIX AVAILABLE
Exploit for HTTP Request Smuggling in Apache Http_ServerApache 2.4.55 mod_proxy HTTP Request Smuggling Exploit
CVE-2022-36760
CVSS 10.0 CRITICAL 2022-07-12
CVE-2022-23943
CVSS 10.0 CRITICAL 2022-03-14FIX AVAILABLE
CVE-2022-22721
CVSS 10.0 CRITICAL 2022-03-14FIX AVAILABLE
CVE-2021-44790 3 exploits
CVSS 10.0 CRITICAL 2021-12-20FIX AVAILABLE
Apache 2.4.x Buffer OverflowApache 2.4.x - Buffer Overflow Exploit
CVE-2021-42013 62 exploits
CVSS 10.0 CRITICAL 2021-10-07
Exploit for Path Traversal in Apache Http_ServerAPACHE-2.4.49-2.4.50-exploit
CVE-2021-26691
CVSS 10.0 CRITICAL 2021-03-01
CVE-2020-11984 1 exploit
CVSS 10.0 CRITICAL 2020-08-07FIX AVAILABLE
Apache2 mod_proxy_uwsgi Incorrect Request Handling Exploit
CVE-2014-6271 144 exploits
CVSS 10.0 CRITICAL 1970-01-01FIX AVAILABLE
Exploit for OS Command Injection in Gnu BashExploit for OS Command Injection in Gnu Bash
CVE-2014-7169 31 exploits
CVSS 10.0 CRITICAL 1970-01-01FIX AVAILABLE
Exploit for OS Command Injection in Gnu BashExploit for OS Command Injection in Gnu Bash
CVE-2010-0425 12 exploits
CVSS 10.0 HIGH 2010-03-02FIX AVAILABLE
Exploit for CVE-2007-6750Apache mod_isapi Dangling Pointer
CVE-2009-4355
CVSS 10.0 HIGH 2010-01-14FIX AVAILABLE
CVE-2009-2412 1 exploit
CVSS 10.0 HIGH 1970-01-01
Apache APR和APR-util整数溢出漏洞
CVE-2022-31813 1 exploit
CVSS 9.8 CRITICAL 2022-06-08
Exploit for Use of Less Trusted Source in Apache Http_Server
CVE-2022-22720
CVSS 9.8 CRITICAL 2022-03-14FIX AVAILABLE
CVE-2021-39275
CVSS 9.8 CRITICAL 2021-08-04FIX AVAILABLE
CVE-2021-20038 6 exploits
CVSS 9.8 CRITICAL 2021-12-07FIX AVAILABLE
Exploit for Out-of-bounds Write in Sonicwall Sma_200_FirmwareExploit for Out-of-bounds Write in Sonicwall Sma_200_Firmware
CVE-2021-41773 156 exploits
CVSS 9.8 CRITICAL 2021-10-04FIX AVAILABLE
vulnlab-platform-labExploit for Path Traversal in Apache Http_Server
CVE-2017-17671 1 exploit
CVSS 9.8 CRITICAL 2017-12-14FIX AVAILABLE
vBulletin LFI
CVE-2017-7679 2 exploits
CVSS 9.8 CRITICAL 2012-02-17FIX AVAILABLE
Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Http_ServerExploit for Cross-site Scripting in Jquery
CVE-2017-3167
CVSS 9.8 CRITICAL 2016-12-05FIX AVAILABLE
CVE-2017-3169
CVSS 9.8 CRITICAL 2012-02-17FIX AVAILABLE
CVE-2009-3555 15 exploits
CVSS 9.8 CRITICAL 1970-01-01FIX AVAILABLE
metasploitable-vulnerability-mapping-with-nmapExploit for Improper Certificate Validation in Apache Http_Server
CVE-2018-18864 1 exploit
CVSS 9.6 CRITICAL 2018-11-20FIX AVAILABLE
Loadbalancer.org Enterprise VA MAX Cross Site Scripting
CVE-2025-23048 1 exploit
CVSS 9.4 CRITICAL 2024-11-25FIX AVAILABLE
📄 Apache mod_ssl TLS 1.3 Client Certificate Authentication Bypass
CVE-2024-38475 1 exploit
CVSS 9.4 CRITICAL 2021-11-09FIX AVAILABLE
Exploit for Improper Encoding or Escaping of Output in Apache Http_Server
CVE-2006-6869 1 exploit
CVSS 9.3 HIGH 2006-12-31FIX AVAILABLE
MDForum 2.0.1 - 'PNSVlang' Remote Code Execution
CVE-2022-28615
CVSS 9.1 CRITICAL 2022-06-08
CVE-2019-10082
CVSS 9.1 CRITICAL 2019-04-12
CVE-2026-23918 16 exploits
CVSS 9.0 HIGH 2025-12-10FIX AVAILABLE
📄 Apache 2.4.66 HTTP/2 mod_http2 Double-Free Denial of Service📄 Apache HTTP Server 2.4.66 Denial of Service
CVE-2024-38472 1 exploit
CVSS 9.0 HIGH 2024-07-01FIX AVAILABLE
Exploit for Server-Side Request Forgery in Apache Http_Server
CVE-2023-27522
CVSS 9.0 HIGH 2023-01-29FIX AVAILABLE
CVE-2021-40438 5 exploits
CVSS 9.0 CRITICAL 2021-09-16FIX AVAILABLE
Exploit for Server-Side Request Forgery in Resf Rocky_LinuxExploit for Server-Side Request Forgery in Resf Rocky_Linux
CVE-2009-3250 1 exploit
CVSS 9.0 HIGH 2009-09-18FIX AVAILABLE
vTiger CRM 5.0.4 - Remote Code Execution / Cross-Site Request Forgery / Local File Inclusion / Cross-Site Scripting
CVE-2022-46157
CVSS 8.8 HIGH 2022-12-09FIX AVAILABLE
CVE-2021-29641 2 exploits
CVSS 8.8 HIGH 2021-04-07FIX AVAILABLE
Monospace Directus Headless CMS File Upload / Rule Bypass VulnerabilitiesMonospace Directus Headless CMS File Upload / Rule Bypass
CVE-2019-13980
CVSS 8.8 HIGH 2019-07-19FIX AVAILABLE
CVE-2025-58098
CVSS 8.7 HIGH 2025-01-01FIX AVAILABLE
CVE-2024-10395
CVSS 8.6 HIGH 2025-02-03
CVE-2024-38473 1 exploit
CVSS 8.5 HIGH 2024-04-01FIX AVAILABLE
Exploit for Improper Encoding or Escaping of Output in Apache Http_Server
CVE-2019-0215
CVSS 8.5 HIGH 2019-01-23FIX AVAILABLE
CVE-2019-10097
CVSS 8.5 HIGH 2019-04-03
CVE-2013-3239 6 exploits
CVSS 8.5 HIGH 2013-04-26FIX AVAILABLE
phpMyAdmin 3.5.8 and 4.0.0-RC2 - Multiple VulnerabilitiesphpMyAdmin 'filename_template' 远程代码执行(CVE-2013-3239)
CVE-2021-44224
CVSS 8.2 HIGH 2021-12-20FIX AVAILABLE