Read the docs

Openmediavault

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Openmediavault records in CISA KEV

No Openmediavault vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Openmediavault 4 records HIGH

Records

4 records

TI-2020-15965 CVE-2020-26124 · GHSA-f68r-v9vp-fxgw

openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code…

Priority HIGH 74

openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.65392 Published 2020-10-02 No fix listed CWE-94
TI-2025-32216 CVE-2025-50674 · GHSA-36x2-2rm5-fgp4

An issue was discovered in the changePassword method in file…

Priority HIGH 69

An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticated attackers to escalate privileges to root.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00189 Published 2025-08-22 No fix listed CWE-20
TI-2017-14404 CVE-2017-1000065 · GHSA-f39j-8xh4-fg4g

Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release…

Priority LOW 29

Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionality allows attackers to inject arbitrary web scripts and execute malicious scripts…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00741 Published 2017-07-13 No fix listed CWE-79
Open these records in search →