Vendors / Rpcms Records 7 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 2
Exploited now Rpcms records in CISA KEV No Rpcms vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 73
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator account.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00481 · Published 2022-10-13 · No fix listed CWE-352
Priority MEDIUM 58
A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00409 · Published 2023-12-14 · No fix listed CWE-79
Priority MEDIUM 40
In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01171 · Published 2021-07-26 · No fix listed
Priority LOW 30
RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01375 · Published 2022-10-13 · No fix listed CWE-79
Priority LOW 29
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change the password of any account.
CVSS 3.1 MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00365 · Published 2022-10-13 · No fix listed CWE-352
Priority LOW 25
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00527 · Published 2021-07-26 · No fix listed CWE-79
Priority LOW 25
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00527 · Published 2021-07-26 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
0 2 5 0 0
THREATIST.IORead the docs