rConfig

Records48All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical13CVSS 9.0–10.0

CVSS high26CVSS 7.0–8.9

Exploited now

rConfig records in CISA KEV

TI-2020-08234 rConfig OS Command Injection Vulnerability CRITICAL 97KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records

Rconfig 45 records CRITICAL

Records

48 records

TI-2020-08234 CVE-2020-10221 · GHSA-hxjm-95v4-6qjj

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to…

CRITICAL 97KEV

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.77123 Published 2020-03-08 No fix listed CWE-78

TI-2020-08233 CVE-2020-10220 · GHSA-3c3m-ffrh-rq6p

An issue was discovered in rConfig through 3.9.4.

CRITICAL 87

An issue was discovered in rConfig through 3.9.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99697 Published 2020-03-07 No fix listed CWE-89

TI-2019-12460 CVE-2019-16662 · GHSA-qcxg-gw47-6c75

An issue was discovered in rConfig 3.9.2.

CRITICAL 87

An issue was discovered in rConfig 3.9.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.97702 Published 2019-10-28 No fix listed CWE-78

TI-2020-08465 CVE-2020-10546 · GHSA-9xcw-ph39-7c5x

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL…

HIGH 84

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.8733 Published 2020-06-04 No fix listed CWE-89

TI-2020-08761 CVE-2020-10879 · GHSA-mg38-p8q7-69v4

rConfig before 3.9.5 allows command injection by sending a crafted GET request to…

HIGH 83

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83862 Published 2020-03-23 No fix listed CWE-78

TI-2020-10700 CVE-2020-13638 · GHSA-938p-268q-56rj

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass…

HIGH 81

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.76853 Published 2020-11-13 No fix listed CWE-269

TI-2019-12461 CVE-2019-16663 · GHSA-5j5x-jr29-33x7

An issue was discovered in rConfig 3.9.2.

HIGH 79

An issue was discovered in rConfig 3.9.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.84696 Published 2019-10-28 No fix listed CWE-78

TI-2019-14054 CVE-2019-19509 · GHSA-x3cx-x4wj-hr2m

An issue was discovered in rConfig 3.9.3.

HIGH 76

An issue was discovered in rConfig 3.9.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.71635 Published 2020-01-06 No fix listed CWE-78

TI-2023-20297 CVE-2023-39110 · GHSA-9hpj-qhwv-cw2q

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the…

HIGH 73

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03651 Published 2023-08-01 No fix listed CWE-918

TI-2023-20296 CVE-2023-39109 · GHSA-v7q5-m92r-6wc2

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the…

HIGH 73

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0394 Published 2023-08-01 No fix listed CWE-918

TI-2023-20295 CVE-2023-39108 · GHSA-52h3-hh53-6ggr

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the…

HIGH 73

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0394 Published 2023-08-01 No fix listed CWE-918

TI-2020-09791 CVE-2020-12255 · GHSA-5rv6-786c-qwh8

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the…

HIGH 72

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.58085 Published 2020-05-18 No fix listed CWE-434

TI-2020-09795 CVE-2020-12259 · GHSA-q5v7-9h83-6g6f

rConfig 3.9.4 is vulnerable to reflected XSS.

HIGH 69

rConfig 3.9.4 is vulnerable to reflected XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.96352 Published 2020-05-18 No fix listed CWE-79

TI-2020-09792 CVE-2020-12256 · GHSA-cw43-3hjf-j7v7

rConfig 3.9.4 is vulnerable to reflected XSS.

HIGH 69

rConfig 3.9.4 is vulnerable to reflected XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.95937 Published 2020-05-18 No fix listed CWE-79

TI-2020-08467 CVE-2020-10548 · GHSA-59cr-f2p3-c96w

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection.

HIGH 68

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.36513 Published 2020-06-04 No fix listed CWE-89

TI-2020-08466 CVE-2020-10547 · GHSA-m2x2-97x9-744w

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php…

HIGH 68

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.36563 Published 2020-06-04 No fix listed CWE-89

TI-2020-08468 CVE-2020-10549 · GHSA-24vx-3r2r-h4mc

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection.

HIGH 66

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.32124 Published 2020-06-04 No fix listed CWE-89

TI-2019-13839 CVE-2019-19207 · GHSA-c9mw-j2hr-q3qj

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection.

MEDIUM 58

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.22116 Published 2019-11-21 No fix listed CWE-89

TI-2020-14469 CVE-2020-23151 · GHSA-v7w4-m8g5-3vvf

rConfig 3.9.5 allows command injection by sending a crafted GET request to…

MEDIUM 51

rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function without being escaped.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05718 Published 2021-08-09 No fix listed CWE-78

TI-2020-07538 CVE-2020-9425 · GHSA-gvgg-46qc-f5hw

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4.

MEDIUM 51

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.19037 Published 2020-03-20 No fix listed CWE-670

TI-2026-54242 CVE-2026-77915 · GHSA-3xhw-7rxv-vwc7

rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php

MEDIUM 49

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() c…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00773 Published 2026-08-24 Fixed in 8.2.10 CWE-1188

TI-2022-22133 CVE-2022-45030 · GHSA-mxgf-h7gp-5prx

A SQL injection vulnerability in rConfig 3.9.7 exists via…

MEDIUM 49

A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02685 Published 2023-04-15 No fix listed CWE-89

TI-2022-21805 CVE-2022-44384 · GHSA-vwc9-qw9m-64xj

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute…

MEDIUM 49

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05637 Published 2022-11-17 No fix listed CWE-434

TI-2020-12387 CVE-2020-15715 · GHSA-hrww-g57w-hvr9

rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on…

MEDIUM 49

rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.04202 Published 2020-07-28 No fix listed

TI-2020-10772 CVE-2020-13778 · GHSA-5prv-83cx-r2j9

rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by…

MEDIUM 45

rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or lib/ajaxHandlers/ajaxEditTemplate.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04392 Published 2020-10-19 No fix listed CWE-78

Open these records in search →

Critical	13
High	26
Medium	9
Low	0
No CVSS	0