Skip to content
OpenAdvisories

Vendor

R-SOFT SERWIS

5 known vulnerabilities.

Products

DMS 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-41879

    Weak password hashing in R-SOFT DMS

    R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file. This issue …

    R-SOFT SERWIS DMS
  • High 7.1
    CVE-2026-41878

    Insecure Direct Object Reference in R-SOFT DMS

    R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any…

    R-SOFT SERWIS DMS
  • High 8.7
    CVE-2026-41876

    OS Command Injection in R-SOFT DMS

    R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with …

    R-SOFT SERWIS DMS