Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: OPEN BMCS Clear all filters
TI-2021-22335 CVE-2021-47718 · GHSA-94fr-f773-p7wg

OpenBMCS Directory Listing Information Disclosure

Priority HIGH 77

OpenBMCS 2.4 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive files by exploiting directory listing functionality.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00546 Published 2025-12-09 No fix listed CWE-548
TI-2021-22321 CVE-2021-47704 · GHSA-j96r-4w2q-c7qw

OpenBMCS SQL Injection via obix_test.php

Priority HIGH 79

OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00407 Published 2025-12-09 No fix listed CWE-89
TI-2021-22320 CVE-2021-47703 · GHSA-hff9-gq78-65hw

OpenBMCS Server Side Request Forgery (SSRF) via /php/query.php

Priority MEDIUM 64

OpenBMCS 2.4 contains an unauthenticated SSRF vulnerability that allows attackers to bypass firewalls and initiate service and network enumeration on the internal network through the affected application, allowing hijack…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00321 Published 2025-12-09 No fix listed CWE-918
TI-2021-22319 CVE-2021-47702 · GHSA-9qgr-cjq2-5m82

OpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.php

Priority LOW 23

OpenBMCS 2.4 contains a CSRF vulnerability that allows attackers to perform actions with administrative privileges by exploiting the sendFeedback.php endpoint.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00193 Published 2025-12-09 No fix listed CWE-352
TI-2021-22318 CVE-2021-47701 · GHSA-3rfh-phff-7g8v

OpenBMCS User Management Privilege Escalation

Priority LOW 38

OpenBMCS 2.4 allows an attacker to escalate privileges from a read user to an admin user by manipulating permissions and exploiting a vulnerability in the update_user_permissions.php script.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00481 Published 2025-12-09 No fix listed CWE-862