Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #20709, adds module for Twonky Server Authentication Bypass (CVE-2025-13315,CVE-2025-13316) Auxiliary module for CVE-2025-13315/CVE-2025-13316 - Twonky Server Log Leak Authentication Bypass	Nov 28, 2025	msutovsky-r7
Land #20718, adds module for Monsta FTP RCE (CVE-2025-34299) Add Monsta FTP downloadFile RCE (CVE-2025-34299)	Nov 27, 2025	msutovsky-r7
Land #20482, fixes bug in HTTP-based login scanners Fix HTTP-based login scanners when using SSL with custom port	Nov 25, 2025	msutovsky-r7
Land #20705, adds modules for Flowise RCEs (CVE-2025-59528, CVE-2025-8943) Add Flowise RCE exploits (CVE-2025-59528, CVE-2025-8943)	Nov 21, 2025	msutovsky-r7
Land #20701, adds windows WSL registry persistence module Windows WSL registry persistence	Nov 20, 2025	msutovsky-r7
Land #20707, adds note "CAP_SYS_BOOT privileges are required" to Linux Reboot payloads Add note "CAP_SYS_BOOT privileges are required" to Linux Reboot payloads	Nov 19, 2025	msutovsky-r7

Title

Date

Author

Land #20709, adds module for Twonky Server Authentication Bypass (CVE-2025-13315,CVE-2025-13316) Auxiliary module for CVE-2025-13315/CVE-2025-13316 - Twonky Server Log Leak Authentication Bypass

Nov 28, 2025

msutovsky-r7

Land #20718, adds module for Monsta FTP RCE (CVE-2025-34299) Add Monsta FTP downloadFile RCE (CVE-2025-34299)

Nov 27, 2025

msutovsky-r7

Land #20482, fixes bug in HTTP-based login scanners Fix HTTP-based login scanners when using SSL with custom port

Nov 25, 2025

msutovsky-r7

Land #20705, adds modules for Flowise RCEs (CVE-2025-59528, CVE-2025-8943) Add Flowise RCE exploits (CVE-2025-59528, CVE-2025-8943)

Nov 21, 2025

msutovsky-r7

Land #20701, adds windows WSL registry persistence module Windows WSL registry persistence

Nov 20, 2025

msutovsky-r7

Land #20707, adds note "CAP_SYS_BOOT privileges are required" to Linux Reboot payloads Add note "CAP_SYS_BOOT privileges are required" to Linux Reboot payloads

Nov 19, 2025

msutovsky-r7

Latest Pull Requests

Name	Labels	Author
fix a typo with the use of CVE-2025-55102, it should be CVE-2025-55182	easy , rn-no-release-notes	sfewer-r7
Drop the ldap_esc_vulnerable_cert_finder tests	rn-no-release-notes	zeroSteiner
Adds PPC reverse payloads to fetch adapters	payload , easy , rn-payload-enhancement	msutovsky-r7
Add RSC digest RCE scanner for CVE-2025-55182 and CVE-2025-66478		inwpu
Create صباح القشطه		eshkamir1-debug
Add Grav CMS Twig SSTI Sandbox Bypass RCE Exploit Module & Documentation	module , docs , rn-modules	nakkouchtarek

Name

Labels

Author

fix a typo with the use of CVE-2025-55102, it should be CVE-2025-55182

easy , rn-no-release-notes

sfewer-r7

Drop the ldap_esc_vulnerable_cert_finder tests

rn-no-release-notes

zeroSteiner

Adds PPC reverse payloads to fetch adapters

payload , easy , rn-payload-enhancement

msutovsky-r7

Add RSC digest RCE scanner for CVE-2025-55182 and CVE-2025-66478

inwpu

Create صباح القشطه

eshkamir1-debug

Add Grav CMS Twig SSTI Sandbox Bypass RCE Exploit Module & Documentation

module , docs , rn-modules

nakkouchtarek

Create a Pull Request

Recent Blog Posts

Fri Dec 12 2025

Metasploit Wrap-Up 12/12/2025

React2shell ModuleAs you may have heard, on December 3, 2025, the React team announced a critical Remote Code Execution (RCE) vulnerability in servers using the React Server Components (RSC) Flight protocol. The vulnerability...

Fri Dec 05 2025

Metasploit Wrap-Up 12/05/2025

Twonky Auth Bypass, RCEs and RISC-V Reverse Shell PayloadsThis was another fantastic week in terms of PR contribution to the Metasploit Framework. Rapid7’s very own Ryan Emmons recently disclosed CVE-2025-13315 and CVE-2025-1...

Fri Nov 28 2025

Metasploit Wrap-Up 11/28/2025

This week, we have added 10 new modules to Metasploit Framework including an SMB to MSSQL relay module, a remote code execution module targeting Fortinet software, additional 32-bit and 64-bit RISC-V payloads, and more.The SM...

View More Metasploit Blog Posts