Rconfig

CVE-2026-77915 Aug 24, 16:11 CRITICAL PATCH Act Now

Unauthenticated administrator account registration in rConfig 8.0.0 through the affected releases lets any remote attacker create a fully privileged Admin user by hitting a POST /register route that was supposed to be disabled. A duplicate bare Auth::routes() call in routes/web.php re-enables self-registration, and because the registration controller never assigns a role while the users.role column defaults to Admin, the new account is instantly authenticated with full administrative rights. Reported by VulnCheck; no public exploit identified at time of analysis, but the flaw is trivially reachable and grants access to stored device credentials, user data, and API token issuance.

CVE-2026-77914 Aug 24, 16:07 HIGH PATCH This Week

Authenticated path traversal in rConfig before 8.2.13 allows any logged-in user to read arbitrary files accessible by the application process by supplying crafted filenames containing directory traversal sequences to the export download endpoint. The fix is confirmed in rConfig V8 Core 8.2.13, released as a dedicated security update and documented in GitHub advisory GHSA-m5rw-jcrm-mmwc. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the release notes reveal that 8.2.13 simultaneously patched multiple related path-containment deficiencies across the application, indicating a systemic pattern rather than an isolated flaw.

CVE-2026-64826 Aug 12, 20:44 HIGH PATCH This Week

Path traversal in rConfig's file download endpoint exposes arbitrary files readable by the web server process to authenticated users. Affected versions prior to 8.2.13 fail to sanitize the filename GET parameter in the download_export() method, allowing ../ sequences to escape the exports directory. An attacker with valid credentials can exfiltrate sensitive application files including .env files containing encryption keys, database credentials, and mail configuration. No public exploit code or KEV listing has been identified at time of analysis.

CVE-2022-44384 Nov 17, 17:15 HIGH POC Act Now

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-10221 Mar 08, 22:15 HIGH POC KEV THREAT Act Now

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-10220 Mar 07, 23:15 CRITICAL POC THREAT Emergency

An issue was discovered in rConfig through 3.9.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-16662 Oct 28, 12:15 CRITICAL POC THREAT Emergency

An issue was discovered in rConfig 3.9.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2026-63102 Jul 20, 15:31 MEDIUM PATCH This Month

Privilege escalation in rConfig before 8.2.8 allows any authenticated low-privilege user to self-assign or assign the Admin role to arbitrary accounts via a missing allowlist and absent authorization check in the Users API. The StoreUserRequest handler accepts a caller-supplied role field without validating it against permitted values and without verifying the requesting account already holds Admin status, enabling direct mass-assignment of the Admin role to any user model during creation or profile updates. No public exploit code has been identified and CISA KEV listing is absent; a vendor-released patch is available in version 8.2.8.

CVE-2023-39110 Aug 01, 14:15 HIGH POC This Week

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-39109 Aug 01, 14:15 HIGH POC This Week

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClass.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-39108 Aug 01, 14:15 HIGH POC This Week

rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClass.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-24366 Mar 27, 21:15 MEDIUM POC This Month

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-29006 Oct 11, 13:15 MEDIUM POC This Month

rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-29005 Oct 11, 13:15 HIGH POC This Week

Insecure permission of chmod command on rConfig server 3.9.6 exists. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-29004 Oct 11, 12:15 HIGH POC This Week

rConfig 3.9.6 is affected by SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-13638 Nov 13, 20:15 CRITICAL POC THREAT Act Now

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-13778 Oct 19, 13:15 HIGH POC This Week

rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or lib/ajaxHandlers/ajaxEditTemplate.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-15715 Jul 28, 14:15 CRITICAL Act Now

rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-15714 Jul 28, 14:15 HIGH This Week

rConfig 3.9.5 is vulnerable to SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-15713 Jul 28, 14:15 HIGH This Week

rConfig 3.9.5 is vulnerable to SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-15712 Jul 28, 14:15 MEDIUM This Month

rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-10549 Jun 04, 04:15 CRITICAL POC THREAT Act Now

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-10548 Jun 04, 04:15 CRITICAL POC THREAT Act Now

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-10547 Jun 04, 04:15 CRITICAL POC THREAT Act Now

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-10546 Jun 04, 04:15 CRITICAL POC THREAT Act Now

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-12256 May 18, 15:15 MEDIUM POC THREAT This Month

rConfig 3.9.4 is vulnerable to reflected XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-12255 May 18, 15:15 HIGH This Week

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-12258 May 18, 14:15 CRITICAL Act Now

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-12257 May 18, 14:15 HIGH POC This Week

rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-12259 May 18, 13:15 MEDIUM POC THREAT This Month

rConfig 3.9.4 is vulnerable to reflected XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-10879 Mar 23, 22:15 CRITICAL POC PATCH THREAT Act Now

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2020-9425 Mar 20, 18:15 HIGH POC PATCH THREAT This Week

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2019-19372 Nov 28, 15:15 HIGH This Week

A downloadFile.php download_file path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-19207 Nov 21, 22:15 HIGH POC THREAT This Week

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-16663 Oct 28, 12:15 HIGH POC THREAT This Week

An issue was discovered in rConfig 3.9.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.