https://patchfirst.co/technique/T1505.003/New and newly exploited CVEs that lead to ATT&CK T1505.003 Web Shell, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 13:00:36 GMThttps://patchfirst.co/cve/CVE-2025-52691/CVE-2025-52691#kevMon, 26 Jan 2026 00:00:00 GMTSmarterTools · SmarterMail. In CISA KEV since 2026-01-26, known ransomware use. ENISA EUVD lists it as exploited. EPSS 85.7% (higher than 99.72% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Named in 1 threat report. Priority 88.8 of 100.kevransomwarepublic-exploitT1190T1059T1505.003https://patchfirst.co/cve/CVE-2018-4063/CVE-2018-4063#kevFri, 12 Dec 2025 00:00:00 GMTSierra Wireless · AirLink ALEOS. In CISA KEV since 2025-12-12. ENISA EUVD lists it as exploited. EPSS 27.3% (higher than 98.1% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 73.8 of 100.kevpublic-exploitT1190T1505.003https://patchfirst.co/cve/CVE-2025-35939/CVE-2025-35939#kevMon, 02 Jun 2025 00:00:00 GMTCraft CMS · Craft CMS. In CISA KEV since 2025-06-02. ENISA EUVD lists it as exploited. EPSS 1.3% (higher than 71.5% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1059 Command and Scripting Interpreter. Priority 56.0 of 100.kevT1190T1505.003T1059https://patchfirst.co/cve/CVE-2025-4427/CVE-2025-4427#kevMon, 19 May 2025 00:00:00 GMTIvanti · Endpoint Manager Mobile (EPMM). In CISA KEV since 2025-05-19. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 68.2 of 100.kevpublic-exploitT1190T1059T1505.003https://patchfirst.co/cve/CVE-2025-42999/CVE-2025-42999#kevThu, 15 May 2025 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2025-05-15, known ransomware use. ENISA EUVD lists it as exploited. EPSS 12.9% (higher than 96.3% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 78.6 of 100.kevransomwarepublic-exploitT1190T1059T1505.003https://patchfirst.co/cve/CVE-2025-31324/CVE-2025-31324#kevTue, 29 Apr 2025 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2025-04-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1505.003 Web Shell; T1059 Command and Scripting Interpreter; T1602 Data from Configuration Repository. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1055T1505.003T1059T1602https://patchfirst.co/cve/CVE-2025-3928/CVE-2025-3928#kevMon, 28 Apr 2025 00:00:00 GMTCommvault · Web Server. In CISA KEV since 2025-04-28. ENISA EUVD lists it as exploited. EPSS 2.5% (higher than 84.9% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 61.1 of 100.kevT1059T1505.003https://patchfirst.co/cve/CVE-2023-20118/CVE-2023-20118#kevMon, 03 Mar 2025 00:00:00 GMTCisco · Small Business RV Series Routers. In CISA KEV since 2025-03-03. ENISA EUVD lists it as exploited. EPSS 54.1% (higher than 99% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 62.8 of 100.kevT1068T1078T1059T1505.003https://patchfirst.co/cve/CVE-2024-11680/CVE-2024-11680#kevTue, 03 Dec 2024 00:00:00 GMTProjectSend · ProjectSend. In CISA KEV since 2024-12-03. ENISA EUVD lists it as exploited. EPSS 91.8% (higher than 99.82% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1098 Account Manipulation; T1505.003 Web Shell. Priority 69.8 of 100.kevpublic-exploitT1190T1098T1505.003https://patchfirst.co/cve/CVE-2024-39717/CVE-2024-39717#kevFri, 23 Aug 2024 00:00:00 GMTVersa · Director. In CISA KEV since 2024-08-23. ENISA EUVD lists it as exploited. EPSS 4.0% (higher than 90.5% of CVEs). CVSS 7.2 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 61.1 of 100.kevT1190T1505.003https://patchfirst.co/cve/CVE-2024-21893/CVE-2024-21893#kevWed, 31 Jan 2024 00:00:00 GMTIvanti · Connect Secure, Policy Secure, and Neurons. In CISA KEV since 2024-01-31, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1505.003 Web Shell; T1555 Credentials from Password Stores. Priority 78.7 of 100.kevransomwarepublic-exploitT1190T1078T1505.003T1555https://patchfirst.co/cve/CVE-2024-21887/CVE-2024-21887Fri, 12 Jan 2024 00:00:00 GMTIvanti · Connect Secure and Policy Secure. In CISA KEV since 2024-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell; T1552 Unsecured Credentials. Named in 4 threat reports. Priority 88.4 of 100.kevransomwarepublic-exploitT1190T1059T1505.003T1552https://patchfirst.co/cve/CVE-2023-46805/CVE-2023-46805Fri, 12 Jan 2024 00:00:00 GMTIvanti · Connect Secure and Policy Secure. In CISA KEV since 2024-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1505.003 Web Shell; T1555 Credentials from Password Stores. Named in 4 threat reports. Priority 87.7 of 100.kevransomwarepublic-exploitT1190T1078T1505.003T1555https://patchfirst.co/cve/CVE-2023-32315/CVE-2023-32315#kevThu, 24 Aug 2023 00:00:00 GMTIgnite Realtime · Openfire. In CISA KEV since 2023-08-24. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1202 Indirect Command Execution; T1505.003 Web Shell; T1087.002 Domain Account; T1496 Resource Hijacking. Named in 1 threat report. Priority 82.1 of 100.kevpublic-exploitT1202T1505.003T1087.002T1496https://patchfirst.co/cve/CVE-2023-26360/CVE-2023-26360Thu, 23 Mar 2023 00:00:00 GMTAdobe · ColdFusion. In CISA KEV since 2023-03-15. ENISA EUVD lists it as exploited. EPSS 97.3% (higher than 99.9% of CVEs). CVSS 8.6 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.007 JavaScript; T1003.001 LSASS Memory; T1036.005 Match Legitimate Resource Name or Location; T1046 Network Service Discovery; T1071.001 Web Protocols; +3 more. Priority 69.0 of 100.kevpublic-exploitT1190T1059.007T1003.001T1036.005T1046T1071.001T1105T1484.001T1505.003https://patchfirst.co/cve/CVE-2023-22952/CVE-2023-22952#kevThu, 02 Feb 2023 00:00:00 GMTSugarCRM · Multiple Products. In CISA KEV since 2023-02-02. ENISA EUVD lists it as exploited. EPSS 80.1% (higher than 99.62% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1021.001 Remote Desktop Protocol; T1070.004 File Deletion; T1078 Valid Accounts; T1083 File and Directory Discovery; +3 more. Priority 69.1 of 100.kevpublic-exploitT1190T1059T1021.001T1070.004T1078T1083T1482T1505.003T1530https://patchfirst.co/cve/CVE-2022-41352/CVE-2022-41352#kevThu, 20 Oct 2022 00:00:00 GMTSynacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-10-20, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.5% (higher than 99.87% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1505.003https://patchfirst.co/cve/CVE-2022-41082/CVE-2022-41082Mon, 03 Oct 2022 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2022-09-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. ATT&CK: T1059.001 PowerShell; T1078 Valid Accounts; T1087 Account Discovery; T1482 Domain Trust Discovery; T1505.003 Web Shell; T1567 Exfiltration Over Web Service. Priority 78.6 of 100.kevransomwarepublic-exploitT1059.001T1078T1087T1482T1505.003T1567https://patchfirst.co/cve/CVE-2022-22963/CVE-2022-22963#kevThu, 25 Aug 2022 00:00:00 GMTVMware Tanzu · Spring Cloud. In CISA KEV since 2022-08-25. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.007 JavaScript; T1505.003 Web Shell. Priority 69.9 of 100.kevpublic-exploitT1190T1059.007T1505.003https://patchfirst.co/cve/CVE-2022-22954/CVE-2022-22954#kevThu, 14 Apr 2022 00:00:00 GMTVMware · Workspace ONE Access and Identity Manager. In CISA KEV since 2022-04-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1505.003 Web Shell. Priority 79.9 of 100.kevransomwarepublic-exploitT1505.003https://patchfirst.co/cve/CVE-2017-12615/CVE-2017-12615#kevFri, 25 Mar 2022 00:00:00 GMTApache · Tomcat. In CISA KEV since 2022-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 78.7 of 100.kevransomwarepublic-exploitT1190T1505.003https://patchfirst.co/cve/CVE-2017-12617/CVE-2017-12617#kevFri, 25 Mar 2022 00:00:00 GMTApache · Tomcat. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Named in 1 threat report. Priority 72.5 of 100.kevpublic-exploitT1190T1059T1505.003https://patchfirst.co/cve/CVE-2021-27860/CVE-2021-27860#kevMon, 10 Jan 2022 00:00:00 GMTFatPipe · WARP, IPVPN, and MPVPN software. In CISA KEV since 2022-01-10. ENISA EUVD lists it as exploited. EPSS 39.7% (higher than 98.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1505.003 Web Shell. Named in 1 threat report. Priority 72.8 of 100.kevpublic-exploitT1505.003https://patchfirst.co/cve/CVE-2021-44228/CVE-2021-44228#kevFri, 10 Dec 2021 00:00:00 GMTApache · Log4j2. In CISA KEV since 2021-12-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1486 Data Encrypted for Impact; T1496 Resource Hijacking; T1505.003 Web Shell; T1608.001 Upload Malware. Named in 10 threat reports. Priority 90.0 of 100.kevransomwarepublic-exploitT1190T1486T1496T1505.003T1608.001https://patchfirst.co/cve/CVE-2021-44077/CVE-2021-44077#kevWed, 01 Dec 2021 00:00:00 GMTZoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus. In CISA KEV since 2021-12-01. ENISA EUVD lists it as exploited. EPSS 93.3% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Priority 69.8 of 100.kevpublic-exploitT1190T1505.003T1003T1003.003T1027T1047T1070.004T1087.002T1136T1140T1218T1560.001T1573.001https://patchfirst.co/cve/CVE-2021-26855/CVE-2021-26855#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1090 Proxy; T1005 Data from Local System; T1505.003 Web Shell. Named in 5 threat reports. Priority 89.4 of 100.kevransomwarepublic-exploitT1133T1090T1005T1505.003https://patchfirst.co/cve/CVE-2019-0604/CVE-2019-0604#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · SharePoint. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1505.003 Web Shell; T1608.001 Upload Malware; T1003 OS Credential Dumping. Named in 4 threat reports. Priority 88.8 of 100.kevransomwarepublic-exploitT1190T1041T1505.003T1608.001T1003https://patchfirst.co/cve/CVE-2021-27065/CVE-2021-27065#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1505.003 Web Shell. Named in 4 threat reports. Priority 87.4 of 100.kevransomwarepublic-exploitT1505.003https://patchfirst.co/cve/CVE-2020-0688/CVE-2020-0688#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.97% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1110 Brute Force; T1114 Email Collection; T1505.003 Web Shell. Named in 3 threat reports. Priority 86.9 of 100.kevransomwarepublic-exploitT1190T1110T1114T1505.003https://patchfirst.co/cve/CVE-2021-26857/CVE-2021-26857#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.8% (higher than 99.87% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1505.003 Web Shell. Named in 3 threat reports. Priority 86.2 of 100.kevransomwarepublic-exploitT1505.003https://patchfirst.co/cve/CVE-2019-18935/CVE-2019-18935#kevWed, 03 Nov 2021 00:00:00 GMTProgress · Telerik UI for ASP.NET AJAX. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1041 Exfiltration Over C2 Channel; T1496 Resource Hijacking; T1505.003 Web Shell. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1041T1496T1505.003https://patchfirst.co/cve/CVE-2021-40539/CVE-2021-40539#kevWed, 03 Nov 2021 00:00:00 GMTZoho · ManageEngine. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.0% (higher than 99.93% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell; T1003 OS Credential Dumping; T1003.003 NTDS; T1027 Obfuscated Files or Information; T1047 Windows Management Instrumentation; +7 more. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1505.003T1003T1003.003T1027T1047T1070.004T1087.002T1136T1140T1218T1560.001T1573.001https://patchfirst.co/cve/CVE-2021-26858/CVE-2021-26858#kevWed, 03 Nov 2021 00:00:00 GMTMicrosoft · Exchange Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 93.7% (higher than 99.84% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1505.003 Web Shell. Named in 3 threat reports. Priority 81.2 of 100.kevransomwareT1505.003https://patchfirst.co/cve/CVE-2019-8394/CVE-2019-8394#kevWed, 03 Nov 2021 00:00:00 GMTZoho · ManageEngine. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 63.3% (higher than 99.21% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 67.4 of 100.kevpublic-exploitT1190T1505.003https://patchfirst.co/cve/CVE-2021-36741/CVE-2021-36741#kevWed, 03 Nov 2021 00:00:00 GMTTrend Micro · Apex One, Apex One as a Service, and Worry-Free Business Security. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 5.0% (higher than 92.2% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1505.003 Web Shell. Priority 62.6 of 100.kevT1190T1505.003https://patchfirst.co/cve/CVE-2020-15189/CVE-2020-15189Fri, 18 Sep 2020 00:00:00 GMTinunosinsi · soycms. Not in CISA KEV. EPSS 2.8% (higher than 86.5% of CVEs). CVSS 6.8 MEDIUM. ATT&CK: T1505.003 Web Shell; T1059 Command and Scripting Interpreter. Priority 22.1 of 100.T1505.003T1059https://patchfirst.co/cve/CVE-2020-12029/CVE-2020-12029Mon, 20 Jul 2020 00:00:00 GMTRockwell Automation · FactoryTalk View SE. Not in CISA KEV. EPSS 47.0% (higher than 98.8% of CVEs). CVSS 9.0 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1505.003 Web Shell; T1059 Command and Scripting Interpreter. Priority 31.1 of 100.public-exploitT1133T1505.003T1059https://patchfirst.co/cve/CVE-2020-5297/CVE-2020-5297Wed, 03 Jun 2020 00:00:00 GMToctobercms · october. Not in CISA KEV. EPSS 1.2% (higher than 67.7% of CVEs). CVSS 3.4 LOW. Public exploit code exists. ATT&CK: T1505.003 Web Shell; T1059 Command and Scripting Interpreter. Priority 20.9 of 100.public-exploitT1505.003T1059https://patchfirst.co/cve/CVE-2020-11010/CVE-2020-11010Mon, 20 Apr 2020 00:00:00 GMTtortoise · tortoise-orm. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 17.2 of 100.T1133T1059T1005T1136T1190T1505.003T1565.001https://patchfirst.co/cve/CVE-2020-3240/CVE-2020-3240Wed, 15 Apr 2020 00:00:00 GMTCisco · Cisco UCS Director. Not in CISA KEV. EPSS 38.7% (higher than 98.6% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1133 External Remote Services; T1005 Data from Local System; T1505.003 Web Shell; T1003.008 /etc/passwd and /etc/shadow; T1059 Command and Scripting Interpreter; T1552.001 Credentials In Files. Priority 26.6 of 100.T1133T1005T1505.003T1003.008T1059T1552.001https://patchfirst.co/cve/CVE-2019-18234/CVE-2019-18234Mon, 23 Dec 2019 00:00:00 GMTNot in CISA KEV. EPSS 1.9% (higher than 79.5% of CVEs). ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 15.9 of 100.T1133T1059T1005T1136T1190T1505.003T1565.001