Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29 results
Jul 5, 2026A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5.CVE-2026-14736 · Other software · Ruijie · reported by VulDBMedium 5.5
A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorducn9h68n9289.feishu.cnvuldb.com
Oct 14, 2025Ruijie RG-UAC Application Management Gateway contains a command injection vulnerability via the 'nmc_sync.php' interface.CVE-2023-7304 · Other software · Ruijie Networks Co., Ltd. · reported by VulnCheckCritical 9.3
Ruijie RG-UAC Application Management Gateway contains a command injection vulnerability via the 'nmc_sync.php' interface. An unauthenticated attacker able to reach the affected endpoint can inject shell commands via crafted request data, causing the application to execute arbitrary commands on the host. Successful exploitation can yield full control of the application process and may lead to system-level access depending on the service privileges. VulnCheck has observed this vulnerability being targeted by the RondoDox botnet campaign.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcn-sec.comvulncheck.com
Jun 23, 2024A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical.CVE-2024-6269 · Other software · Ruijie · reported by VulDBMedium 5.1
A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects the function get_ip.addr_details of the file /view/vpn/autovpn/sxh_vpnlic.php of the component HTTP POST Request Handler. The manipulation of the argument indevice leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269482 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical.CVE-2024-6187 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/vpn/autovpn/sub_commit.php. The manipulation of the argument key leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0.CVE-2024-6186 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC 1.0. This affects an unknown part of the file /view/userAuthentication/SSO/commit.php. The manipulation of the argument ad_log_name leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0.CVE-2024-6185 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC 1.0. Affected by this issue is the function get_ip_addr_details of the file /view/dhcp/dhcpConfig/commit.php. The manipulation of the argument ethname leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269156. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2024A vulnerability classified as critical was found in Ruijie RG-UAC 1.0.CVE-2024-6184 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Ruijie RG-UAC 1.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/reboot/reboot_commit.php. The manipulation of the argument servicename leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269155. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2024A vulnerability was found in Ruijie RG-UAC up to 20240516.CVE-2024-5340 · Other software · Ruijie · reported by VulDBMedium 5.1
A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/vpn/autovpn/sub_commit.php. The manipulation of the argument key leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266246 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2024A vulnerability was found in Ruijie RG-UAC up to 20240516.CVE-2024-5339 · Other software · Ruijie · reported by VulDBMedium 5.1
A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/vpn/autovpn/online_check.php. The manipulation of the argument peernode leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2024A vulnerability was found in Ruijie RG-UAC up to 20240516.CVE-2024-5338 · Other software · Ruijie · reported by VulDBMedium 5.1
A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been classified as critical. Affected is an unknown function of the file /view/vpn/autovpn/online.php. The manipulation of the argument peernode leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266244. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2024A vulnerability was found in Ruijie RG-UAC up to 20240516 and classified as critical.CVE-2024-5337 · Other software · Ruijie · reported by VulDBMedium 5.1
A vulnerability was found in Ruijie RG-UAC up to 20240516 and classified as critical. This issue affects some unknown processing of the file /view/systemConfig/sys_user/user_commit.php. The manipulation of the argument email2/user_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266243. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2024A vulnerability has been found in Ruijie RG-UAC up to 20240516 and classified as critical.CVE-2024-5336 · Other software · Ruijie · reported by VulDBMedium 5.1
A vulnerability has been found in Ruijie RG-UAC up to 20240516 and classified as critical. This vulnerability affects the function addVlan of the file /view/networkConfig/vlan/vlan_add_commit.php. The manipulation of the argument phyport leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-266242 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506.CVE-2024-4816 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506. This affects an unknown part of the file /view/networkConfig/GRE/gre_add_commit.php. The manipulation of the argument name/remote/local/IP leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263937 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506.CVE-2024-4815 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506. Affected by this issue is some unknown functionality of the file /view/bugSolve/viewData/detail.php. The manipulation of the argument filename leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263936. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240506.CVE-2024-4814 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240506. Affected by this vulnerability is an unknown functionality of the file /view/networkConfig/RouteConfig/StaticRoute/static_route_edit_commit.php. The manipulation of the argument oldipmask/oldgateway leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263935. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506.CVE-2024-4813 · Other software · Ruijie · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506. Affected is an unknown function of the file /view/networkConfig/physicalInterface/interface_commit.php. The manipulation of the argument name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-263934 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability was found in Ruijie RG-UAC up to 20240428.CVE-2024-4510 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/networkConfig/ArpTable/arp_add_commit.php. The manipulation of the argument text_ip_addr/text_mac_addr leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263114 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability was found in Ruijie RG-UAC up to 20240428.CVE-2024-4509 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/IPV6/naborTable/add_commit.php. The manipulation of the argument ip_addr/mac_addr leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263113 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability was found in Ruijie RG-UAC up to 20240428.CVE-2024-4508 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been classified as critical. Affected is an unknown function of the file /view/IPV6/ipv6StaticRoute/static_route_edit_ipv6.php. The manipulation of the argument oldipmask/oldgateway/olddevname leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263112. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical.CVE-2024-4507 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability was found in Ruijie RG-UAC up to 20240428 and classified as critical. This issue affects some unknown processing of the file /view/IPV6/ipv6StaticRoute/static_route_add_ipv6.php. The manipulation of the argument text_prefixlen/text_gateway/devname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263111. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability has been found in Ruijie RG-UAC up to 20240428 and classified as critical.CVE-2024-4506 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability has been found in Ruijie RG-UAC up to 20240428 and classified as critical. This vulnerability affects unknown code of the file /view/IPV6/ipv6Addr/ip_addr_edit_commit.php. The manipulation of the argument text_ip_addr/orgprelen/orgname leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263110 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240428.CVE-2024-4505 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240428. This affects an unknown part of the file /view/IPV6/ipv6Addr/ip_addr_add_commit.php. The manipulation of the argument prelen/ethname leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263109 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428.CVE-2024-4504 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428. Affected by this issue is some unknown functionality of the file /view/HAconfig/baseConfig/commit.php. The manipulation of the argument peer_ip/local_ip leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263108. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240428.CVE-2024-4503 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240428. Affected by this vulnerability is an unknown functionality of the file /view/dhcp/dhcpConfig/dhcp_relay_commit.php. The manipulation of the argument interface_from leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263107. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240428.CVE-2024-4502 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240428. Affected is an unknown function of the file /view/dhcp/dhcpClient/dhcp_client_commit.php. The manipulation of the argument ifName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263106 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2024A vulnerability was found in Ruijie RG-UAC up to 20240428.CVE-2024-4501 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been rated as critical. This issue affects some unknown processing of the file /view/bugSolve/captureData/commit.php. The manipulation of the argument tcpDump leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263105 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2024A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240419.CVE-2024-4255 · Other software · Ruijie · reported by VulDBMedium 4.7
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240419. This issue affects some unknown processing of the file /view/network Config/GRE/gre_edit_commit.php. The manipulation of the argument name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262145 was assigned to this vulnerability.
- Product
- RG-UAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Ruijie RG-UAC 6000-E50 commit 9071227 was discovered to contain a cross-site scripting (XSS) vulnerability via the rule_name parameter.CVE-2020-21639 · Other software · Ruijie · reported by MITREMedium 6.1
Ruijie RG-UAC 6000-E50 commit 9071227 was discovered to contain a cross-site scripting (XSS) vulnerability via the rule_name parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Rg-uac 6000-e50 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Ruijie RG-UAC commit 9071227 was discovered to contain a vulnerability in the component /current_action.php?action=reboot, which allows attackers to cause a denCVE-2020-21627 · Other software · Ruijie · reported by MITREHigh 7.5
Ruijie RG-UAC commit 9071227 was discovered to contain a vulnerability in the component /current_action.php?action=reboot, which allows attackers to cause a denial of service (DoS) via unspecified vectors.
- Product
- Rg-uac Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.