rpcms records

7 published records for vendor rpcms.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

7 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2021-37394No exploit	In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.rpcms · rpcms	High8.8	—	1.2%	Jul 26, 2021
35Monitor	CVE-2022-41475No exploit	RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator accounrpcms · rpcms · CWE-352 Pre-auth CSRF	High8.8	—	0.4%	Oct 13, 2022
26Monitor	CVE-2022-41474No exploit	RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change the password of any rpcms · rpcms · CWE-352 Pre-auth CSRF	Medium6.5	—	0.3%	Oct 13, 2022
24Monitor	CVE-2022-41473Proof of concept	RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.rpcms · rpcms · CWE-79 Pre-auth XSS	Medium6.1	—	1.1%	Oct 13, 2022
21Monitor	CVE-2021-37392No exploit	In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page.rpcms · rpcms · CWE-79 XSS	Medium5.4	—	0.5%	Jul 26, 2021
21Monitor	CVE-2021-37393No exploit	In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page.rpcms · rpcms · CWE-79 XSS	Medium5.4	—	0.5%	Jul 26, 2021
21Monitor	CVE-2023-50565No exploit	A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scrirpcms · rpcms · CWE-79 RCE XSS	Medium5.4	—	0.4%	Dec 14, 2023

CVE-2021-37394
35Monitor
In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.
HighCVSS 8.8No exploitEPSS 1%
rpcms · rpcmsJul 26, 2021
CVE-2022-41475
35Monitor
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator accoun
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
rpcms · rpcmsOct 13, 2022
CVE-2022-41474
26Monitor
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change the password of any
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- CSRF
rpcms · rpcmsOct 13, 2022
CVE-2022-41473
24Monitor
RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
rpcms · rpcmsOct 13, 2022
CVE-2021-37392
21Monitor
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page.
MediumCVSS 5.4No exploitEPSS 1%
- XSS
rpcms · rpcmsJul 26, 2021
CVE-2021-37393
21Monitor
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page.
MediumCVSS 5.4No exploitEPSS 1%
- XSS
rpcms · rpcmsJul 26, 2021
CVE-2023-50565
21Monitor
A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scri
MediumCVSS 5.4No exploitEPSS 0%
- RCE
- XSS
rpcms · rpcmsDec 14, 2023