R-SOFT SERWIS

Records5All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

R-SOFT SERWIS records in CISA KEV

No R-SOFT SERWIS vulnerabilities are listed in CISA KEV.

5 records

TI-2026-30285 CVE-2026-41880 · GHSA-p8q4-pvx5-wjx2

MEDIUM 44

R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.01331 Published 2026-07-10 Fixed in v3.19-2862, v3.17-2580 CWE-78

TI-2026-30281 CVE-2026-41876 · GHSA-pf8q-xpjj-9vfv

MEDIUM 42

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01228 Published 2026-07-10 Fixed in v3.19-2752, v3.17-2580 CWE-78

TI-2026-30284 CVE-2026-41879 · GHSA-2mx5-42xw-7586

MEDIUM 41

R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00269 Published 2026-07-10 Fixed in v3.17-2000 CWE-328

TI-2026-30283 CVE-2026-41878 · GHSA-m5fr-qm38-x8f3

LOW 32

R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0047 Published 2026-07-10 Fixed in v3.19-2862, v3.17-2580 CWE-639

TI-2026-30282 CVE-2026-41877 · GHSA-c9ph-5j66-3j9f

LOW 23

R-SOFT DMS is vulnerable to Stored XSS in file upload functionality.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0039 Published 2026-07-10 Fixed in v3.19-2832, v3.17-2580 CWE-79