Skip to content
Noroxi

rConfig records

45 published records for vendor rconfig.

Researcher profile

Entered KEV
1 · 2.2%
Weaponized
5 · 11.1%
Pre-auth RCE
3
With a fix record
4.4%
Median publish → KEV
605 days

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

45 records
  • CVE-2020-10221
    88Now

    lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacte

    HighCVSS 8.8KEVWeaponizedEPSS 77%

    rconfig · rconfigMar 8, 2020

  • CVE-2020-10220
    69This week

    An issue was discovered in rConfig through 3.9.4.

    CriticalCVSS 9.8WeaponizedEPSS 99%

    rconfig · rconfigMar 7, 2020

  • CVE-2019-16662
    68This week

    An issue was discovered in rConfig 3.9.2.

    CriticalCVSS 9.8WeaponizedEPSS 97%

    rconfig · rconfigOct 28, 2019

  • CVE-2020-10546
    65This week

    rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection.

    CriticalCVSS 9.8Proof of conceptEPSS 87%

    rconfig · rconfigJun 4, 2020

  • CVE-2020-10879
    64This week

    rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is pas

    CriticalCVSS 9.8Proof of conceptEPSS 83%

    rconfig · rconfigMar 23, 2020

  • CVE-2020-13638
    62This week

    lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation.

    CriticalCVSS 9.8Proof of conceptEPSS 76%

    rconfig · rconfigNov 13, 2020

  • CVE-2019-16663
    60This week

    An issue was discovered in rConfig 3.9.2.

    HighCVSS 8.8Proof of conceptEPSS 84%

    rconfig · rconfigOct 28, 2019

  • CVE-2019-19509
    56Plan

    An issue was discovered in rConfig 3.9.3.

    HighCVSS 8.8WeaponizedEPSS 71%

    rconfig · rconfigJan 6, 2020

  • CVE-2020-12255
    52Plan

    rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality.

    HighCVSS 8.8Proof of conceptEPSS 58%

    rconfig · rconfigMay 18, 2020

  • CVE-2020-12259
    50Plan

    rConfig 3.9.4 is vulnerable to reflected XSS.

    MediumCVSS 5.4Proof of conceptEPSS 96%

    rconfig · rconfigMay 18, 2020

  • CVE-2020-12256
    50Plan

    rConfig 3.9.4 is vulnerable to reflected XSS.

    MediumCVSS 5.4Proof of conceptEPSS 95%

    rconfig · rconfigMay 18, 2020

  • CVE-2020-10547
    50Plan

    rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection.

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    rconfig · rconfigJun 4, 2020

  • CVE-2020-10548
    50Plan

    rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection.

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    rconfig · rconfigJun 4, 2020

  • CVE-2020-10549
    49Plan

    rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection.

    CriticalCVSS 9.8Proof of conceptEPSS 32%

    rconfig · rconfigJun 4, 2020

  • CVE-2019-19207
    42Plan

    rConfig 3.9.2 allows devices.php?searchColumn= SQL injection.

    HighCVSS 8.8No exploitEPSS 22%

    rconfig · rconfigNov 21, 2019

  • CVE-2020-23151
    41Plan

    rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is

    CriticalCVSS 9.8No exploitEPSS 5%

    rconfig · rconfigAug 9, 2021

  • CVE-2022-44384
    40Plan

    An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.

    HighCVSS 8.8WeaponizedEPSS 5%

    rconfig · rconfigNov 17, 2022

  • CVE-2020-15715
    40Plan

    rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.ph

    CriticalCVSS 9.9No exploitEPSS 4%

    rconfig · rconfigJul 28, 2020

  • CVE-2020-25359
    37Monitor

    An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6.

    CriticalCVSS 9.1No exploitEPSS 2%

    rconfig · rconfigAug 20, 2021

  • CVE-2020-12258
    37Monitor

    rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled.

    CriticalCVSS 9.1No exploitEPSS 1%

    rconfig · rconfigMay 18, 2020

  • CVE-2020-9425
    36Monitor

    An issue was discovered in includes/head.inc.php in rConfig before 3.9.4.

    HighCVSS 7.5Proof of conceptEPSS 19%

    rconfig · rconfigMar 20, 2020

  • CVE-2020-13778
    36Monitor

    rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxA

    HighCVSS 8.8No exploitEPSS 4%

    rconfig · rconfigOct 19, 2020

  • CVE-2023-39109
    36Monitor

    rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/co

    HighCVSS 8.8Proof of conceptEPSS 3%

    rconfig · rconfigAug 1, 2023

  • CVE-2023-39108
    36Monitor

    rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/co

    HighCVSS 8.8Proof of conceptEPSS 3%

    rconfig · rconfigAug 1, 2023

  • CVE-2023-39110
    36Monitor

    rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php.

    HighCVSS 8.8Proof of conceptEPSS 3%

    rconfig · rconfigAug 1, 2023