rathena vulnerabilities

Products

• fluxcp 4
• rathena 4

Latest rathena CVEs

Newest publication first

1. CVE-2026-116254 rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation

   Published 2026-10-26

   Medium·CVSS 6.9 EPSS 0.26%

   A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to or...

2. CVE-2025-62797 CSRF in FluxCP account endpoints allows account takeover / state-changing actions

   Published 2025-10-29

   High·CVSS 8.6 EPSS 0.24%

   FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated request...

3. CVE-2025-62170 rAthena map-server use-after-free vulnerability in RODEX

   Published 2025-10-13

   High·CVSS 7.5 EPSS 0.37%

   rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific attacking scenario to ca...

4. CVE-2025-58750 rAthena missing bound check in chclif_parse_moveCharSlot

   Published 2025-09-09

   Critical·CVSS 9.1 EPSS 0.30%

   rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in chclif_parse_moveCharSlot that can result in reading and writing out of bounds using input from the user. The pro...

5. CVE-2025-58448 rAthena has SQL Injection in PartyBooking component via `WorldName` parameter.

   Published 2025-09-09

   Critical·CVSS 9.8 EPSS 0.36%

   rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via WorldName parameter. Commit 0d89ae0 fixes the issue.

6. CVE-2025-58447 rAthena has heap-based buffer overflow in login server

   Published 2025-09-09

   Critical·CVSS 9.8 EPSS 0.88%

   rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted CA_SSO_LOGIN_...

7. CVE-2024-45799 Javascript Injection in Vending Info/Buyers Info Module in FluxCP

   Published 2024-09-16

   Medium·CVSS 6.1 EPSS 0.28%

   FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the sh...

8. CVE-2022-4421 rAthena FluxCP Service Desk Image URL view.php cross site scripting

   Published 2022-12-12

   Medium·CVSS 6.1 EPSS 0.44%

   A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view.php of the component Service Desk Image URL Handler. The manipulation of the argument sslink leads to cross site scripti...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.