RhinOS
by RhinOS
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-5407 | Cri | 0.65 | 10.0 | 0.01 | May 27, 2024 | A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote attacker to perform a reverse shell on the remote system, compromising the entire infrastructure. | ||
| CVE-2024-5409 | Hig | 0.46 | 7.1 | 0.00 | May 27, 2024 | RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php. An attacker could create a malicious URL and send it to a victim to obtain their session details. | ||
| CVE-2024-5408 | Hig | 0.46 | 7.1 | 0.00 | May 27, 2024 | Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm. This vulnerability could allow a remote attacker to steal details of a victim's user session by submitting a specially crafted URL. | ||
| CVE-2018-18760 | Med | 0.45 | 6.5 | 0.03 | Nov 16, 2018 | RhinOS 3.0 build 1190 allows CSRF. |
- risk 0.65cvss 10.0epss 0.01
A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote attacker to perform a reverse shell on the remote system, compromising the entire infrastructure.
- risk 0.46cvss 7.1epss 0.00
RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php. An attacker could create a malicious URL and send it to a victim to obtain their session details.
- risk 0.46cvss 7.1epss 0.00
Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm. This vulnerability could allow a remote attacker to steal details of a victim's user session by submitting a specially crafted URL.
- risk 0.45cvss 6.5epss 0.03
RhinOS 3.0 build 1190 allows CSRF.