Vulnerabilities

TI-2025-28748 CVE-2025-45242 · GHSA-4v2j-gjc9-p494

Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the…

LOW 34

Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00366 Published 2025-05-05 No fix listed CWE-922

TI-2024-36778 CVE-2024-55089 · GHSA-ghpw-cph8-v3rm

Server-side request forgery in Rhymix

MEDIUM 47

Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entities.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00215 Published 2024-12-18 Fixed in 2.1.24 CWE-918

TI-2018-13895 CVE-2018-19601 · GHSA-756g-77hp-9phc

Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

MEDIUM 42

Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

CVSS 3.0CRITICAL 9.1 Network High privileges No interaction EPSS 0.01439 Published 2019-01-03 No fix listed CWE-918

TI-2018-13894 CVE-2018-19600 · GHSA-pxmh-q2jw-fgfx

Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

LOW 23

Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00668 Published 2019-01-03 No fix listed CWE-79

Vulnerabilities

Filters

Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the…

Server-side request forgery in Rhymix

Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.