Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: R-SOFT SERWIS Clear all filters
TI-2026-30284 CVE-2026-41879 · GHSA-2mx5-42xw-7586

Weak password hashing in R-SOFT DMS

Priority MEDIUM 41

R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00269 Published 2026-07-10 Fixed in v3.17-2000 CWE-328
TI-2026-30283 CVE-2026-41878 · GHSA-m5fr-qm38-x8f3

Insecure Direct Object Reference in R-SOFT DMS

Priority LOW 32

R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0047 Published 2026-07-10 Fixed in v3.19-2862, v3.17-2580 CWE-639
TI-2026-30285 CVE-2026-41880 · GHSA-p8q4-pvx5-wjx2

OS Command Injection in R-SOFT DMS

Priority MEDIUM 44

R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module.

CVSS 4.0CRITICAL 9.0 Network Low privileges No interaction EPSS 0.01331 Published 2026-07-10 Fixed in v3.19-2862, v3.17-2580 CWE-78
TI-2026-30282 CVE-2026-41877 · GHSA-c9ph-5j66-3j9f

Stored XSS in R-SOFT DMS

Priority LOW 23

R-SOFT DMS is vulnerable to Stored XSS in file upload functionality.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0039 Published 2026-07-10 Fixed in v3.19-2832, v3.17-2580 CWE-79
TI-2026-30281 CVE-2026-41876 · GHSA-pf8q-xpjj-9vfv

OS Command Injection in R-SOFT DMS

Priority MEDIUM 42

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01228 Published 2026-07-10 Fixed in v3.19-2752, v3.17-2580 CWE-78