Rukovoditel

Records53All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

Rukovoditel records in CISA KEV

No Rukovoditel vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Rukovoditel 52 records HIGH

Records

52 records in Rukovoditel · all components

TI-2022-23834 CVE-2022-48175 · GHSA-3g23-95wx-3cc6

Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability…

HIGH 82

Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0174 Published 2023-01-30 No fix listed CWE-94

TI-2022-22098 CVE-2022-44945 · GHSA-8727-g4p6-v7h7

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.

HIGH 82

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00953 Published 2022-12-02 No fix listed CWE-89

TI-2022-21064 CVE-2022-43168 · GHSA-w94c-984j-7hp6

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.

HIGH 76

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01096 Published 2022-10-28 No fix listed CWE-89

TI-2022-21130 CVE-2022-43288 · GHSA-pr7f-w5w8-8mp6

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the…

HIGH 73

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0089 Published 2022-11-14 No fix listed CWE-89

TI-2022-22128 CVE-2022-45020 · GHSA-pqpr-w68x-43cr

Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS)…

HIGH 71

Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00617 Published 2022-12-05 No fix listed CWE-79

TI-2020-10668 CVE-2020-13590 · GHSA-67vh-2x8f-2mwq

SQL injection in Rukovoditel Project Management App

HIGH 65

Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00858 Published 2022-04-18 No fix listed CWE-89

TI-2024-22799 CVE-2024-34469 · GHSA-q82h-pmf9-x2xf

Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.

MEDIUM 64

Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00589 Published 2024-05-04 No fix listed CWE-79

TI-2020-09491 CVE-2020-11819 · GHSA-xghj-v4x3-gwvf

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a…

MEDIUM 64

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.26778 Published 2020-04-16 No fix listed CWE-22

TI-2023-30196 CVE-2023-53913 · GHSA-rcqj-85jm-wmw8

Rukovoditel 3.3.1 CSV Injection via User Account Export

MEDIUM 61

Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field.

CVSS 4.0MEDIUM 6.2 Network Low privileges User interaction EPSS 0.00732 Published 2025-12-17 No fix listed CWE-1236

TI-2022-22105 CVE-2022-44952 · GHSA-g82r-v699-q3p8

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 60

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00991 Published 2022-12-02 No fix listed CWE-79

TI-2022-22104 CVE-2022-44951 · GHSA-9q4r-4j83-rq5m

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 60

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01027 Published 2022-12-02 No fix listed CWE-79

TI-2022-21065 CVE-2022-43169 · GHSA-jmw7-4jx6-672c

A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01207 Published 2022-10-28 No fix listed CWE-79

TI-2022-21063 CVE-2022-43167 · GHSA-3hh9-hvm7-hpc8

A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML vi…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01164 Published 2022-10-28 No fix listed CWE-79

TI-2022-21062 CVE-2022-43166 · GHSA-4mrm-8fhj-6fh8

A stored cross-site scripting (XSS) vulnerability in the Global Entities feature…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a c…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01095 Published 2022-10-28 No fix listed CWE-79

TI-2022-21061 CVE-2022-43165 · GHSA-fpp7-4jrj-q54q

A stored cross-site scripting (XSS) vulnerability in the Global Variables feature…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a c…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01095 Published 2022-10-28 No fix listed CWE-79

TI-2022-21060 CVE-2022-43164 · GHSA-xp38-vhvm-v2x7

A stored cross-site scripting (XSS) vulnerability in the Global Lists feature…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a cra…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01095 Published 2022-10-28 No fix listed CWE-79

TI-2022-22103 CVE-2022-44950 · GHSA-fhg7-w742-r4m6

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01049 Published 2022-12-02 No fix listed CWE-79

TI-2022-22102 CVE-2022-44949 · GHSA-35c8-q6x2-rx7f

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01049 Published 2022-12-02 No fix listed CWE-79

TI-2022-22101 CVE-2022-44948 · GHSA-58hx-jfqv-58wx

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00982 Published 2022-12-02 No fix listed CWE-79

TI-2022-22100 CVE-2022-44947 · GHSA-3r5j-phw6-cxph

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01054 Published 2022-12-02 No fix listed CWE-79

TI-2022-22099 CVE-2022-44946 · GHSA-hxxw-7qv6-75jv

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01128 Published 2022-12-02 No fix listed CWE-79

TI-2022-22097 CVE-2022-44944 · GHSA-55cm-jv9m-hwg9

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS)…

MEDIUM 58

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01137 Published 2022-12-02 No fix listed CWE-79

TI-2022-21066 CVE-2022-43170 · GHSA-xf87-5w9c-m6cq

A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01095 Published 2022-10-28 No fix listed CWE-79

TI-2023-30181 CVE-2023-53898 · GHSA-6598-86pr-wm97

Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Configuration

MEDIUM 56

Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00245 Published 2025-12-16 No fix listed CWE-79

TI-2023-30180 CVE-2023-53897 · GHSA-w8hg-xmw6-8fvg

Rukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Comments

MEDIUM 56

Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00245 Published 2025-12-16 No fix listed CWE-79

Open these records in search →