Sploitus

27 exploited vulnerabilities in Lighttpd

Vulnerabilities with publicly known exploits

Vendors
Totolink, Lighttpd, Alt Linux, Grandstream, Cdata, Suse
With known exploits
27
Affected Grandstream gac2500 Firmware versions
≤ 1.0.3.35
Affected Lighttpd versions
< 1.4.35, 1.4.67, 1.4.56, 1.4.57, 1.4.58, 1.4.15, 1.4.31, 1.4.32, 1.4.30, 1.5.0, 1.4.25, 1.0.2, 1.0.3, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.8, 1.3.9, 1.3.10, 1.3.11, 1.3.12, 1.3.13, 1.3.14, 1.3.15, 1.3.16, 1.4.0, 1.4.2, 1.4.3, 1.4.18
Affected Hanwhasecurity Web Viewer versions
= 1.0.0.193

Vulnerabilities with exploits

Highest CVSS first — 12 of these already have exploit code on Sploitus

CVE-2026-15701
CVSS 10.0 CRITICAL 2026-06-11FIX AVAILABLE
CVE-2026-7546
CVSS 10.0 CRITICAL 2026-05-01
CVE-2025-70327
CVSS 10.0 CRITICAL 2025-10-22FIX AVAILABLE
CVE-2019-11072
CVSS 10.0 CRITICAL 2019-04-10FIX AVAILABLE
CVE-2019-10655 6 exploits
CVSS 9.8 CRITICAL 2019-03-30FIX AVAILABLE
Grandstream GXV31XX 'settimezone' Unauthenticated Command ExecutionGrandstream GXV31XX settimezone Unauthenticated Command Execution Exploit
CVE-2020-29058
CVSS 9.8 CRITICAL 2019-12-27
CVE-2014-2323 2 exploits
CVSS 9.8 CRITICAL 1970-01-01FIX AVAILABLE
Vision2 - Nmap's XML result parse and NVD's CPE correlation to search CVElighttpd 'mod_mysql_vhost.c' SQL注入漏洞
CVE-2025-34125
CVSS 9.3 CRITICAL 2025-04-15FIX AVAILABLE
CVE-2017-16524 6 exploits
CVSS 8.8 HIGH 2017-11-06FIX AVAILABLE
Samsung SRN-1670D Web Viewer 1.0.0.193 Arbitrary File Read / UploadWeb Viewer 1.0.0.193 (Samsung SRN-1670D) - Unrestricted File Upload Exploit
CVE-2025-67445
CVSS 7.8 HIGH 2025-12-18FIX AVAILABLE
CVE-2022-41556 3 exploits
CVSS 7.8 HIGH 2022-09-02FIX AVAILABLE
📄 Lighttpd 1.4.66 FastCGI Resource ExhaustionLighttpd 1.4.56 - 1.4.66 Resource Leak Denial of Service PoC
CVE-2022-37797
CVSS 7.8 HIGH 2022-08-08
CVE-2018-19052
CVSS 7.8 HIGH 2018-08-21FIX AVAILABLE
CVE-2015-3200 1 exploit
CVSS 7.8 HIGH 2015-05-25FIX AVAILABLE
Vision2 - Nmap's XML result parse and NVD's CPE correlation to search CVE
CVE-2022-30780 2 exploits
CVSS 7.5 HIGH 2021-02-05FIX AVAILABLE
Exploit for Incorrect Calculation in LighttpdExploit for Incorrect Calculation in Lighttpd
CVE-2020-24573
CVSS 7.5 HIGH 2020-11-12FIX AVAILABLE
CVE-2019-5149
CVSS 7.5 HIGH 2020-03-10FIX AVAILABLE
CVE-2014-2324 2 exploits
CVSS 7.5 HIGH 1970-01-01FIX AVAILABLE
Vision2 - Nmap's XML result parse and NVD's CPE correlation to search CVElighttpd目录遍历漏洞
CVE-2013-4508
CVSS 7.5 HIGH 2013-11-08FIX AVAILABLE
CVE-2025-2956
CVSS 6.1 MEDIUM 2025-03-30
CVE-2025-8759
CVSS 5.9 MEDIUM 2025-07-29
CVE-2022-22707
CVSS 5.9 MEDIUM 2022-01-06
CVE-2007-3947 2 exploits
CVSS 5.8 MEDIUM 2007-07-23
Lighttpd 1.4.15 - Multiple Code Execution Denial of Service Information Disclosure VulnerabilitiesLighttpd 1.4.15 - Multiple Code Execution / Denial of Service / Information Disclosure Vulnerabilities
CVE-2012-5533 6 exploits
CVSS 5.0 MEDIUM 2012-11-24FIX AVAILABLE
lighttpd 1.4.31 Denial of Service PoClighttpd畸形HTTP Connection域处理拒绝服务漏洞
CVE-2011-4362 7 exploits
CVSS 5.0 MEDIUM 2011-12-24FIX AVAILABLE
lighttpd Denial of Service Vulnerability PoCLighttpd Proof of Concept code for CVE-2011-4362
CVE-2010-0295 3 exploits
CVSS 5.0 MEDIUM 2010-02-03FIX AVAILABLE
lighttpd &lt; 1.4.25-r1 Denial of Servicelighttpd畸形HTTP请求远程拒绝服务漏洞
CVE-2008-1270 1 exploit
CVSS 5.0 MEDIUM 2008-03-10FIX AVAILABLE
Lighttpd 1.4.x - mod_userdir Information Disclosure