rconfig vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

RC

Product

rconfig

by rconfig · last CVE Aug 24, 2026

On CISA KEVExploited in the wild

48

CVEs

1

On KEV

9.9

Max CVSS

0

New 30D

Vulnerabilities48 In the news0 Timeline

Severity mix

Critical 13High 24Medium 11Low 0

Severity

All severities48 Critical13 High24 Medium11 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add rconfig to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2020-15715	9.9	4%	Jul 28	rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script Affected: 3.9.5
CVE-2026-77915	9.8	1%	Aug 24	rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php Affected: 8.0.0 before 8.2.10
CVE-2020-23151	9.8	6%	Aug 9	rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function… Affected: 3.9.5
CVE-2020-13638	9.8	77%	Nov 13	lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation Affected: 3.9.0 before 3.9.7
CVE-2020-10549	9.8	32%	Jun 4	rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection Affected: through 3.9.4
CVE-2020-10548	9.8	37%	Jun 4	rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection Affected: through 3.9.4
CVE-2020-10547	9.8	37%	Jun 4	rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection Affected: through 3.9.4
CVE-2020-10546	9.8	87%	Jun 4	rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection Affected: through 3.9.4
CVE-2020-10879	9.8	84%	Mar 23	rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function… Affected: before 3.9.5
CVE-2020-10220	9.8	100%	Mar 7	An issue was discovered in rConfig through 3.9.4 Affected: through 3.9.4
CVE-2019-16662	9.8	98%	Oct 28	An issue was discovered in rConfig 3.9.2 Affected: 3.9.2
CVE-2020-25359	9.1	2%	Aug 20	An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6 Affected: 3.9.5
CVE-2020-12258	9.1	2%	May 18	rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled Affected: 3.9.4