Rpcms
Vendor:
First CVE: Jul 26, 2021 · Active for 4 years
7
Total CVEs
More Total CVEs than 83% of tracked products
2.3
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
6.6
Avg CVSS
Higher Avg CVSS than 33% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Rpcms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 26, 2021
4 years ago
Most Recent CVE
Dec 14, 2023
953 days ago
CVE Severity & Scoring
Rpcms7 CVEs
71%
29%
All CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network7 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None1 (14.3%)
Unknown0 (0.0%)
Required6 (85.7%)
Privileges Required
Low4 (57.1%)
High0 (0.0%)
None3 (42.9%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-41473MEDIUM RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function. | Oct 13, 2022 | 6.1 | 31 | NO | YES |
CVE-2022-41475HIGH RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator account. | Oct 13, 2022 | 8.8 | 28 | NO | NO |
CVE-2021-37394HIGH In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration. | Jul 26, 2021 | 8.8 | 26 | NO | NO |
CVE-2022-41474MEDIUM RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change the password of any account. | Oct 13, 2022 | 6.5 | 22 | NO | NO |
CVE-2021-37393MEDIUM In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into n | Jul 26, 2021 | 5.4 | 19 | NO | NO |
CVE-2021-37392MEDIUM In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update us | Jul 26, 2021 | 5.4 | 19 | NO | NO |
CVE-2023-50565MEDIUM A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | Dec 14, 2023 | 5.4 | 15 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
14.3% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Rpcms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.5.5 | 1 | 5.4 | 0.4% | 0 | 0 |
| 3.0.2 | 3 | 7.1 | 0.6% | 0 | 1 |