Rhymix vulnerabilities

Products

• Rhymix 5

Latest Rhymix CVEs

Newest publication first

1. CVE-2026-36453 Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.

   Published 2026-09-13

   High·CVSS 7.4 EPSS 0.27%

   Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.

2. CVE-2025-45242 Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php.

   Published 2025-05-05

   High·CVSS 7.7 EPSS 0.37%

   Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php.

3. CVE-2024-55089 Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entities.

   Published 2024-12-18

   Medium·CVSS 4.1 EPSS 0.22%

   Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entities.

4. CVE-2018-19601 Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

   Published 2019-01-03

   Critical·CVSS 9.1 EPSS 1.4%

   Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

5. CVE-2018-19600 Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

   Published 2019-01-03

   Medium·CVSS 4.8 EPSS 0.67%

   Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.