Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: zofe Clear all filters
TI-2026-73455 CVE-2026-110239 · GHSA-6gv8-c7hv-6wpw

Stored cross-site scripting in Rapyd Admin rich-text component

Priority LOW 11

Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00235 Published 2026-10-13 Fixed in 9.20.0 CWE-79
TI-2026-73454 CVE-2026-110238 · GHSA-98h7-qf5m-qq4g

Authorization bypass in Rapyd Admin lets customers modify user accounts

Priority MEDIUM 40

Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersMo…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0046 Published 2026-10-13 Fixed in 9.20.0 CWE-639
TI-2026-71297 CVE-2026-109567 · GHSA-892p-42h6-pggx

Privilege escalation in Rapyd Admin via UsersEdit component

Priority LOW 39

Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00329 Published 2026-10-12 Fixed in 9.20.0 CWE-269
TI-2026-71296 CVE-2026-109566 · GHSA-8x56-m6rj-ff6q

Hard-coded super-admin credentials in Rapyd Admin AuthSeeder

Priority MEDIUM 49

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with passwo…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00668 Published 2026-10-12 Fixed in 9.20.0 CWE-798
TI-2026-71295 CVE-2026-109565 · GHSA-96m9-5rqq-wq2v

Stored XSS in Rapyd Admin select-list component via display names

Priority LOW 23

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00211 Published 2026-10-12 Fixed in 9.20.0 CWE-79