RC
Product
rconfig
On CISA KEVExploited in the wild
48
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 13High 24Medium 11Low 0
Watch
Add rconfig to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-10221 In wildKEV | 8.8 | Mar 8 | rConfig OS Command Injection Vulnerability Affected: through 3.9.4 |
| CVE-2023-39110 | 8.8 | Aug 1 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php Affected: 3.9.4 |
| CVE-2023-39108 | 8.8 | Aug 1 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php Affected: 3.9.4 |
| CVE-2023-39109 | 8.8 | Aug 1 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php Affected: 3.9.4 |
| CVE-2022-45030 | 8.8 | Apr 15 | A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv) Affected: 3.9.7 |
| CVE-2022-44384 | 8.8 | Nov 17 | An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file Affected: 3.9.6 |
| CVE-2021-29005 | 8.8 | Oct 11 | Insecure permission of chmod command on rConfig server 3.9.6 exists Affected: 3.9.6 |
| CVE-2021-29004 | 8.8 | Oct 11 | rConfig 3.9.6 is affected by SQL Injection Affected: 3.9.6 |
| CVE-2020-13778 | 8.8 | Oct 19 | rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or… Affected: through 3.9.4 |
| CVE-2020-15714 | 8.8 | Jul 28 | rConfig 3.9.5 is vulnerable to SQL injection Affected: 3.9.5 |
| CVE-2020-15713 | 8.8 | Jul 28 | rConfig 3.9.5 is vulnerable to SQL injection Affected: 3.9.5 |
| CVE-2020-12255 | 8.8 | May 18 | rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality Affected: 3.9.4 |
| CVE-2020-12257 | 8.8 | May 18 | rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token Affected: 3.9.4 |
| CVE-2019-19509 | 8.8 | Jan 6 | An issue was discovered in rConfig 3.9.3 Affected: 3.9.3 |
| CVE-2019-19207 | 8.8 | Nov 21 | rConfig 3.9.2 allows devices.php?searchColumn= SQL injection Affected: 3.9.2 |
| CVE-2019-16663 | 8.8 | Oct 28 | An issue was discovered in rConfig 3.9.2 Affected: 3.9.2 |
| CVE-2020-27466 | 7.8 | Aug 20 | An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file Affected: 3.9.6 |
| CVE-2020-27464 | 7.8 | Aug 20 | An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file Affected: through 3.9.6 |
| CVE-2019-19585 | 7.8 | Jan 6 | An issue was discovered in rConfig 3.9.3 Affected: 3.9.3 |
| CVE-2020-23150 | 7.5 | Aug 9 | A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to… Affected: 3.9.5 |
| CVE-2020-23149 | 7.5 | Aug 9 | The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database information Affected: 3.9.5 |
| CVE-2020-23148 | 7.5 | Aug 9 | The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST… Affected: 3.9.5 |
| CVE-2020-9425 | 7.5 | Mar 20 | An issue was discovered in includes/head.inc.php in rConfig before 3.9.4 Affected: before 3.9.4 |
| CVE-2019-19372 | 7.5 | Nov 28 | A downloadFile.php download_file path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files Affected: through 3.9.3 |
Showing 24