Is CVE-2019-5640 being actively exploited?

CVE-2019-5640 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2019-5640?

CVE-2019-5640 has a CVSS 3.1 base score of 3.3 (LOW).

CVE-2019-5640

LOW · CVSS 3.3EPSS 0.5%EU EUVD

Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous user

Key facts

CVSS score: 3.3 (v3.1)
Severity: LOW
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-200
EPSS score: 0.5% (44th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2019-15215)
Published: November 22, 2021
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2019-15215 in the EU Vulnerability Database. Last updated in EUVD on September 17, 2024.

View on the EU Vulnerability Database

Affected products

rapid7 / nexpose

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Rapid7™ Nexpose™ Vulnerability Management and Penetration Testing System V5.1 - Rapid7 LLC - Common Criteria 383-4-148 - archived

References

https://docs.rapid7.com/release-notes/nexpose/20211117/(Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain