Rukovoditel Rukovoditel
52 CVEs affecting Rukovoditel Rukovoditel. Latest disclosed: 2025-12-17. Critical: 9, High: 13.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-48175 | Critical | 9.8 | 2023-01-30 | Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request. |
CVE-2022-44945 | Critical | 9.8 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter. |
CVE-2022-43168 | Critical | 9.8 | 2022-10-28 | Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter. |
CVE-2020-11817 | Critical | 9.8 | 2020-04-27 | In Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server just changing the the content-type value. As a result of that, an attacker can exec… |
CVE-2020-11820 | Critical | 9.8 | 2020-04-16 | Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entities_id parameter. |
CVE-2020-11819 | Critical | 9.8 | 2020-04-16 | In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution. |
CVE-2020-11816 | Critical | 9.8 | 2020-04-16 | Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reports_id (POST) parameter. |
CVE-2020-11815 | Critical | 9.8 | 2020-04-16 | In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. As a result of that, an attacker can execute a… |
CVE-2020-11812 | Critical | 9.8 | 2020-04-16 | Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters[0][value] or filters[1][value] parameter. |
CVE-2023-53913 | High | 8.8 | 2025-12-17 | Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can c… |
CVE-2022-45020 | High | 8.8 | 2022-12-05 | Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login. T… |
CVE-2022-43288 | High | 8.8 | 2022-11-14 | Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php. |
CVE-2020-13589 | High | 8.8 | 2021-08-17 | An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The entities_id parameter in t… |
CVE-2020-13588 | High | 8.8 | 2021-08-17 | An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The heading_field_id parameter… |
CVE-2021-30224 | High | 8.8 | 2021-04-29 | Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials. |
CVE-2020-13592 | High | 8.8 | 2021-04-09 | An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP requ… |
CVE-2020-13591 | High | 8.8 | 2021-04-09 | An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HT… |
CVE-2020-13587 | High | 8.8 | 2021-04-09 | An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2. A specially crafted H… |
CVE-2020-11818 | High | 8.8 | 2020-04-16 | In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, a… |
CVE-2018-20166 | High | 8.8 | 2019-01-02 | A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles exten… |