Openbmcs is a narrowly scoped baseboard management controller (BMC) software product that manages low-level server hardware and has a focused vulnerability history centered around web-interface input handling and access control. The recurring weakness classes—including cross-site request forgery, SQL injection, missing authorization checks, and server-side request forgery—reflect common risks in web-facing administrative interfaces where incomplete input validation and authorization enforcement can expose sensitive hardware and configuration data. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Openbmcs over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-47701HIGH OpenBMCS 2.4 allows an attacker to escalate privileges from a read user to an admin user by manipulating permissions and exploiting a vulnerability in the update_user_permissions.p | Dec 9, 2025 | 8.8 | 25 | NO | NO |
CVE-2021-47718HIGH OpenBMCS 2.4 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive files by exploiting directory listing functionality. Attacke | Dec 9, 2025 | 7.5 | 24 | NO | NO |
CVE-2021-47703HIGH OpenBMCS 2.4 contains an unauthenticated SSRF vulnerability that allows attackers to bypass firewalls and initiate service and network enumeration on the internal network through t | Dec 9, 2025 | 7.2 | 23 | NO | NO |
CVE-2021-47704MEDIUM OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code. Attackers can send GET requ | Dec 9, 2025 | 6.5 | 22 | NO | NO |
CVE-2021-47702MEDIUM OpenBMCS 2.4 contains a CSRF vulnerability that allows attackers to perform actions with administrative privileges by exploiting the sendFeedback.php endpoint. Attackers can submit | Dec 9, 2025 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Openbmcs.
Media articles that mention a CVE ID that affects a product developed by Openbmcs — matched by CVE ID, not by vendor name.