Browse CVEs

MEDIUM 5.4 CVE-2026-63102 rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by s… Rconfig 8.2.8+ Fix from $1,6002026-07-20 HIGH 8.8 CVE-2023-39108 rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClas… Rconfig No fix yet Fix from $1,9502023-08-01 HIGH 8.8 CVE-2023-39109 rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClas… Rconfig No fix yet Fix from $1,9502023-08-01 HIGH 8.8 CVE-2023-39110 rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability al… Rconfig No fix yet Fix from $1,9502023-08-01 HIGH 8.8 CVE-2022-45030 A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-pr… Rconfig No fix yet Fix from $1,9502023-04-15 MEDIUM 6.5 CVE-2023-24366 An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request. Rconfig Mitigation only Fix from $1,6002023-03-27 HIGH 8.8 CVE-2022-44384EPSS 5% An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file. Rconfig No fix yet Fix from $1,9502022-11-17 HIGH 8.8 CVE-2021-29005 Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password … Rconfig Mitigation only Fix from $1,9502021-10-11 MEDIUM 6.5 CVE-2021-29006EPSS 6% rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server. Rconfig No fix yet Fix from $1,6002021-10-11 HIGH 8.8 CVE-2021-29004 rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not s… Rconfig Mitigation only Fix from $1,9502021-10-11 CRITICAL 9.1 CVE-2020-25359 An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted r… Rconfig No fix yet Fix from $2,3002021-08-20 HIGH 7.8 CVE-2020-27464 An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file. Rconfig after 3.9.6 Fix from $1,9502021-08-20 HIGH 7.8 CVE-2020-27466 An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a craf… Rconfig Mitigation only Fix from $1,9502021-08-20 MEDIUM 6.5 CVE-2020-25351 An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated attackers … Rconfig No fix yet Fix from $1,6002021-08-20 MEDIUM 6.5 CVE-2020-25353 A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attacke… Rconfig No fix yet Fix from $1,6002021-08-20 MEDIUM 5.4 CVE-2020-25352 A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability a… Rconfig No fix yet Fix from $1,6002021-08-20 CRITICAL 9.8 CVE-2020-23151EPSS 6% rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed d… Rconfig No fix yet Fix from $2,3002021-08-09 HIGH 7.5 CVE-2020-23148 The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive inform… Rconfig No fix yet Fix from $1,9502021-08-09 HIGH 7.5 CVE-2020-23149 The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive databas… Rconfig No fix yet Fix from $1,9502021-08-09 HIGH 7.5 CVE-2020-23150 A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request … Rconfig No fix yet Fix from $1,9502021-08-09 CRITICAL 9.8 CVE-2020-13638EPSS 77% lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been f… Rconfig 3.9.7+ Fix from $2,3002020-11-13 HIGH 8.8 CVE-2020-13778 rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplat… Rconfig after 3.9.4 Fix from $1,9502020-10-19 CRITICAL 9.9 CVE-2020-15715 rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script.… Rconfig Mitigation only Fix from $2,3002020-07-28 HIGH 8.8 CVE-2020-15713 rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.php script using the s… Rconfig Mitigation only Fix from $1,9502020-07-28 HIGH 8.8 CVE-2020-15714 rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php script using … Rconfig Mitigation only Fix from $1,9502020-07-28 CRITICAL 9.8 CVE-2020-10548EPSS 38% rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext,… Rconfig after 3.9.4 Fix from $2,3002020-06-04 CRITICAL 9.8 CVE-2020-10549EPSS 32% rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext… Rconfig after 3.9.4 Fix from $2,3002020-06-04 CRITICAL 9.8 CVE-2020-10546EPSS 87% rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in… Rconfig after 3.9.4 Fix from $2,3002020-06-04 CRITICAL 9.8 CVE-2020-10547EPSS 33% rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are sto… Rconfig after 3.9.4 Fix from $2,3002020-06-04 HIGH 8.8 CVE-2020-12255EPSS 53% rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file uplo… Rconfig Mitigation only Fix from $1,9502020-05-18