Rconfig vulnerabilities

Products

• Rconfig 48

Newest

• rconfig rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php CVE-2026-77915 9.3 CriticalAugust 24, 2026
• rconfig rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint CVE-2026-77914 7.1 HighAugust 24, 2026
• rconfig rConfig < 8.2.13 Path Traversal File Read via FileDownloadController CVE-2026-64826 7.1 HighAugust 12, 2026
• rconfig, rconfig v8 core +1 more rConfig Core < 8.2.8 Privilege Escalation via Users API role field CVE-2026-63102 5.3 MediumJuly 20, 2026
• rconfig rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path... CVE-2023-39110 8.8 HighAugust 1, 2023
• rconfig rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a... CVE-2023-39109 8.8 HighAugust 1, 2023
• rconfig rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b... CVE-2023-39108 8.8 HighAugust 1, 2023
• rconfig A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates... CVE-2022-45030 Public exploit 8.8 HighApril 15, 2023
• rconfig An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive... CVE-2023-24366 6.5 MediumMarch 27, 2023
• rconfig An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary... CVE-2022-44384 Public exploit 8.8 HighNovember 17, 2022
• rconfig Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig... CVE-2021-29005 8.8 HighOctober 11, 2021
• rconfig rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may... CVE-2021-29006 6.5 MediumOctober 11, 2021
• rconfig rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the... CVE-2021-29004 8.8 HighOctober 11, 2021
• rconfig An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6... CVE-2020-27466 7.8 HighAugust 20, 2021
• rconfig An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows... CVE-2020-27464 7.8 HighAugust 20, 2021
• rconfig An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This... CVE-2020-25359 9.1 CriticalAugust 20, 2021
• rconfig A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6.... CVE-2020-25353 6.5 MediumAugust 20, 2021
• rconfig A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5... CVE-2020-25352 5.4 MediumAugust 20, 2021
• rconfig An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This... CVE-2020-25351 6.5 MediumAugust 20, 2021
• rconfig rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers... CVE-2020-23151 9.8 CriticalAugust 9, 2021
• rconfig A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access... CVE-2020-23150 7.5 HighAugust 9, 2021
• rconfig The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to... CVE-2020-23149 7.5 HighAugust 9, 2021
• rconfig The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to... CVE-2020-23148 7.5 HighAugust 9, 2021
• rconfig lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to... CVE-2020-13638 EPSS 76.9% 9.8 CriticalNovember 13, 2020
• rconfig rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a... CVE-2020-13778 8.8 HighOctober 19, 2020
• rconfig rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system... CVE-2020-15715 9.9 CriticalJuly 28, 2020
• rconfig rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted... CVE-2020-15714 8.8 HighJuly 28, 2020
• rconfig rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted... CVE-2020-15713 8.8 HighJuly 28, 2020
• rconfig rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system.... CVE-2020-15712 4.3 MediumJuly 28, 2020
• rconfig rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection.... CVE-2020-10546 EPSS 87.3% 9.8 CriticalJune 4, 2020
• rconfig rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL... CVE-2020-10547 EPSS 36.6% 9.8 CriticalJune 4, 2020
• rconfig rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because,... CVE-2020-10548 EPSS 36.5% 9.8 CriticalJune 4, 2020
• rconfig rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because,... CVE-2020-10549 EPSS 32.1% 9.8 CriticalJune 4, 2020
• rconfig rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file... CVE-2020-12255 Public exploit EPSS 58.1% 8.8 HighMay 18, 2020
• rconfig rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user... CVE-2020-12256 EPSS 95.9% 5.4 MediumMay 18, 2020
• rconfig rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation... CVE-2020-12257 8.8 HighMay 18, 2020
• rconfig rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are... CVE-2020-12258 9.1 CriticalMay 18, 2020
• rconfig rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user... CVE-2020-12259 EPSS 96.4% 5.4 MediumMay 18, 2020
• rconfig rConfig before 3.9.5 allows injection because lib/crud/search.crud.php does not properly... CVE-2020-10879 Public exploit EPSS 83.9% 9.8 CriticalMarch 23, 2020
• rconfig An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated... CVE-2020-9425 EPSS 19.0% 7.5 HighMarch 20, 2020
• rconfig lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute... CVE-2020-10221 In KEVPublic exploit EPSS 77.1% 8.8 HighMarch 8, 2020
• rconfig An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection... CVE-2020-10220 Public exploit EPSS 99.7% 9.8 CriticalMarch 7, 2020
• rconfig An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system... CVE-2019-19509 Public exploit EPSS 71.6% 8.8 HighJanuary 6, 2020
• rconfig An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for... CVE-2019-19585 7.8 HighJanuary 6, 2020
• rconfig ** DISPUTED ** A downloadFile.php download_file path traversal vulnerability in rConfig through 3... CVE-2019-19372 Disputed 7.5 HighNovember 28, 2019
• rconfig rConfig 3.9.2 allows devices.php?searchColumn= SQL injection. CVE-2019-19207 EPSS 22.1% 8.8 HighNovember 21, 2019
• rconfig An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by... CVE-2019-16663 Public exploit EPSS 84.7% 8.8 HighOctober 28, 2019
• rconfig An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by... CVE-2019-16662 Public exploit EPSS 97.7% 9.8 CriticalOctober 28, 2019