GCVE - cpe:2.3:a:rconfig:rconfig:3.9.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rconfig:rconfig:3.9.6:*:*:*:*:*:*:*

part: a version: 3.9.6 update: *

Vendor	Rconfig (`1c009c32-0004-509d-90f2-e11259ac94c2`)
Product	Rconfig (`e0cdb980-ee35-5685-9f30-581dd1c5c510`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:docker/yukh/rconfig`	purl2cpe	2026-06-01 10:13:24.685853
`pkg:github/rconfig/rconfig`	purl2cpe	2026-06-01 10:13:24.685855

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-44384`	vulnerable	2026-06-08 05:49:35.454952	Details available An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file. Published: 2022-11-17T00:00:00.000Z Updated: 2025-04-29T14:53:39.852Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/49783	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-29006`	vulnerable	2026-06-08 05:31:25.336456	Details available rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server. Published: 2021-10-11T12:02:32.000Z Updated: 2026-07-09T00:13:03.884Z Open on db.gcve.eu Reference links https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29006-POC.py	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-29005`	vulnerable	2026-06-08 05:31:25.336031	Details available Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may let an attacker with low privilege to gain root access on server. Published: 2021-10-11T12:04:49.000Z Updated: 2026-07-09T00:13:02.638Z Open on db.gcve.eu Reference links https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29005-POC.sh	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-29004`	vulnerable	2026-06-08 05:31:25.335530	Details available rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the Mysql server is the same as rConfig, an attacker may successfully upload a webshell to the server and access it remotely. Published: 2021-10-11T11:58:33.000Z Updated: 2026-07-09T00:13:01.410Z Open on db.gcve.eu Reference links https://rconfig.com https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2021-29004-POC-req.txt https://github.com/mrojz/rconfig-exploit/blob/main/README.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-27466`	vulnerable	2026-06-08 05:23:52.713910	Details available An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file. Published: 2021-08-20T18:10:56.000Z Updated: 2024-08-04T16:18:44.827Z Open on db.gcve.eu Reference links https://ssd-disclosure.com/ssd-advisory-rconfig-unauthenticated-rce/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.