Rconfig vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Rconfig flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2020-10221 rConfig OS Command InjectionExploited since Nov 3, 2021 · CVSS 8.8

Latest high and critical flaws

• CVE-2026-77915 rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full AdminCritical 9.3 · Aug 24, 2026
• CVE-2026-77914 rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames High 7.1 · Aug 24, 2026
• CVE-2026-64826 rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traHigh 7.1 · Aug 12, 2026
• CVE-2023-39110 rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php.High 8.8 · Aug 1, 2023
• CVE-2023-39109 rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php.High 8.8 · Aug 1, 2023
• CVE-2023-39108 rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php.High 8.8 · Aug 1, 2023
• CVE-2022-45030 A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv).High 8.8 · Apr 14, 2023
• CVE-2022-44384 An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.High 8.8 · Nov 17, 2022
• CVE-2021-29005 Insecure permission of chmod command on rConfig server 3.9.6 exists.High 8.8 · Oct 11, 2021
• CVE-2021-29004 rConfig 3.9.6 is affected by SQL Injection.High 8.8 · Oct 11, 2021
• CVE-2020-27466 An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file.High 7.8 · Aug 20, 2021
• CVE-2020-27464 An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file.High 7.8 · Aug 20, 2021
• CVE-2020-25359 An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6.Critical 9.1 · Aug 20, 2021
• CVE-2020-23151 rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to Critical 9.8 · Aug 9, 2021
• CVE-2020-23150 A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/High 7.5 · Aug 9, 2021
• CVE-2020-23149 The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database informatiHigh 7.5 · Aug 9, 2021
• CVE-2020-23148 The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via aHigh 7.5 · Aug 9, 2021
• CVE-2020-13638 lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation.Critical 9.8 · Nov 13, 2020
• CVE-2020-13778 rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or liHigh 8.8 · Oct 19, 2020
• CVE-2020-15715 rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script.Critical 9.9 · Jul 28, 2020
• CVE-2020-15714 rConfig 3.9.5 is vulnerable to SQL injection.High 8.8 · Jul 28, 2020
• CVE-2020-15713 rConfig 3.9.5 is vulnerable to SQL injection.High 8.8 · Jul 28, 2020
• CVE-2020-10549 rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection.Critical 9.8 · Jun 4, 2020
• CVE-2020-10548 rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection.Critical 9.8 · Jun 4, 2020
• CVE-2020-10547 rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection.Critical 9.8 · Jun 4, 2020