Vulnerabilities

TI-2024-05025 CVE-2024-5409

Cross-site Scripting vulnerability in RhinOS from SaltOS

LOW 31

RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0028 Published 2024-05-27 No fix listed CWE-79

TI-2024-05024 CVE-2024-5408

LOW 31

Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00334 Published 2024-05-27 No fix listed CWE-79

TI-2024-05023 CVE-2024-5407

MEDIUM 50

A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00604 Published 2024-05-27 No fix listed CWE-94

TI-2018-13276 CVE-2018-18760 · GHSA-7v25-cx6v-gf9w

LOW 34

RhinOS 3.0 build 1190 allows CSRF.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.02627 Published 2018-11-16 No fix listed CWE-352