CVE-2020-15715

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script. An attacker could exploit this vulnerability using the nodeId parameter.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/184941Third Party Advisory, VDB Entry
https://www.rconfig.com/downloads/v3-release-notesRelease Notes, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/184941Third Party Advisory, VDB Entry
https://www.rconfig.com/downloads/v3-release-notesRelease Notes, Vendor Advisory

Timeline

Published: Jul 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-157166.1RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker CVE-2020-157176.1RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker CVE-2020-157186.1RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attac CVE-2020-157194.2libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support CVE-2020-157206.8In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify par CVE-2020-157216.1RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.CVE-2020-157227.8In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnera CVE-2020-157237.8In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrome.exe, there exists a CVE-2020-157247.8In the version 12.1.0.1005 and below of 360 Total Security, when the Gamefolde calls GameChrome.exe, there exists a local privilege escalati CVE-2020-15735.5A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2020-157313.6An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to writ CVE-2020-157327.5Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacke