RC
Vendor
rconfig
49
CVEs
1
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-77915 | RC rconfig rconfig | 9.8 | Aug 24 | rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php |
| CVE-2026-77914 | RC rconfig rconfig | 6.5 | Aug 24 | rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint |
| CVE-2026-64826 | RC rConfig rConfig | 6.5 | Aug 12 | rConfig < 8.2.13 Path Traversal File Read via FileDownloadController |
| CVE-2026-63102 | RV rConfig v8 Core rConfig | 5.4 | Jul 20 | rConfig Core < 8.2.8 Privilege Escalation via Users API role field |
| CVE-2023-39108 | RC Rconfig Rconfig | 8.8 | Aug 1 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php |
| CVE-2023-39110 | RC Rconfig Rconfig | 8.8 | Aug 1 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php |
| CVE-2023-39109 | RC Rconfig Rconfig | 8.8 | Aug 1 | rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php |
| CVE-2022-45030 | RC Rconfig Rconfig | 8.8 | Apr 15 | A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv) |
| CVE-2023-24366 | RC Rconfig Rconfig | 6.5 | Mar 27 | An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request |
| CVE-2022-44384 | RC Rconfig Rconfig | 8.8 | Nov 17 | An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file |
| CVE-2021-29006 | RC Rconfig Rconfig | 6.5 | Oct 11 | rConfig 3.9.6 is affected by a Local File Disclosure vulnerability |
| CVE-2021-29005 | RC Rconfig Rconfig | 8.8 | Oct 11 | Insecure permission of chmod command on rConfig server 3.9.6 exists |
| CVE-2021-29004 | RC Rconfig Rconfig | 8.8 | Oct 11 | rConfig 3.9.6 is affected by SQL Injection |
| CVE-2020-27466 | RC Rconfig Rconfig | 7.8 | Aug 20 | An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file |
| CVE-2020-27464 | RC Rconfig Rconfig | 7.8 | Aug 20 | An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file |
| CVE-2020-25359 | RC Rconfig Rconfig | 9.1 | Aug 20 | An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6 |
| CVE-2020-25353 | RC Rconfig Rconfig | 6.5 | Aug 20 | A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6 |
| CVE-2020-25352 | RC Rconfig Rconfig | 5.4 | Aug 20 | A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6 |
| CVE-2020-25351 | RC Rconfig Rconfig | 6.5 | Aug 20 | An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6 |
| CVE-2020-23151 | RC Rconfig Rconfig | 9.8 | Aug 9 | rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function… |
| CVE-2020-23150 | RC Rconfig Rconfig | 7.5 | Aug 9 | A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to… |
| CVE-2020-23149 | RC Rconfig Rconfig | 7.5 | Aug 9 | The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database information |
| CVE-2020-23148 | RC Rconfig Rconfig | 7.5 | Aug 9 | The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST… |
| CVE-2020-13638 | RC Rconfig Rconfig | 9.8 | Nov 13 | lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation |
| CVE-2020-13778 | RC Rconfig Rconfig | 8.8 | Oct 19 | rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or… |
| CVE-2020-15715 | RC Rconfig Rconfig | 9.9 | Jul 28 | rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script |
| CVE-2020-15714 | RC Rconfig Rconfig | 8.8 | Jul 28 | rConfig 3.9.5 is vulnerable to SQL injection |
| CVE-2020-15713 | RC Rconfig Rconfig | 8.8 | Jul 28 | rConfig 3.9.5 is vulnerable to SQL injection |
| CVE-2020-15712 | RC Rconfig Rconfig | 4.3 | Jul 28 | rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system |
| CVE-2020-10549 | RC Rconfig Rconfig | 9.8 | Jun 4 | rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection |
| CVE-2020-10548 | RC Rconfig Rconfig | 9.8 | Jun 4 | rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection |
| CVE-2020-10547 | RC Rconfig Rconfig | 9.8 | Jun 4 | rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection |
| CVE-2020-10546 | RC Rconfig Rconfig | 9.8 | Jun 4 | rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection |
| CVE-2020-12256 | RC Rconfig Rconfig | 5.4 | May 18 | rConfig 3.9.4 is vulnerable to reflected XSS |
| CVE-2020-12255 | RC Rconfig Rconfig | 8.8 | May 18 | rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality |
| CVE-2020-12258 | RC Rconfig Rconfig | 9.1 | May 18 | rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled |
| CVE-2020-12257 | RC Rconfig Rconfig | 8.8 | May 18 | rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token |
| CVE-2020-12259 | RC Rconfig Rconfig | 5.4 | May 18 | rConfig 3.9.4 is vulnerable to reflected XSS |
| CVE-2020-10879 | RC Rconfig Rconfig | 9.8 | Mar 23 | rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function… |
| CVE-2020-9425 | RC Rconfig Rconfig | 7.5 | Mar 20 | An issue was discovered in includes/head.inc.php in rConfig before 3.9.4 |
| CVE-2020-10221 In wildKEV | RC Rconfig Rconfig | 8.8 | Mar 8 | rConfig OS Command Injection Vulnerability |
| CVE-2020-10220 | RC Rconfig Rconfig | 9.8 | Mar 7 | An issue was discovered in rConfig through 3.9.4 |
| CVE-2019-19585 | RC Rconfig Rconfig | 7.8 | Jan 6 | An issue was discovered in rConfig 3.9.3 |
| CVE-2019-19509 | RC Rconfig Rconfig | 8.8 | Jan 6 | An issue was discovered in rConfig 3.9.3 |
| CVE-2019-19372 | RC Rconfig Rconfig | 7.5 | Nov 28 | A downloadFile.php download_file path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files |
| CVE-2019-19207 | RC Rconfig Rconfig | 8.8 | Nov 21 | rConfig 3.9.2 allows devices.php?searchColumn= SQL injection |
| CVE-2019-16663 | RC Rconfig Rconfig | 8.8 | Oct 28 | An issue was discovered in rConfig 3.9.2 |
| CVE-2019-16662 | RC Rconfig Rconfig | 9.8 | Oct 28 | An issue was discovered in rConfig 3.9.2 |